Description
WordPress Plugin Job Manager is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently enumerate and access the uploaded CV files by performing a bruteforce attack on the WordPress upload directory structure. WordPress Plugin Job Manager version 0.7.25 is vulnerable; prior versions may also be affected.
Remediation
Restrict access to CV files (e.g. via .htaccess) or disable the plugin until a fix is available
References
Related Vulnerabilities
e107 Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2010-5084)
SharePoint CVE-2020-16950 Vulnerability (CVE-2020-16950)
SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2024-38024)
PHP NULL Pointer Dereference Vulnerability (CVE-2016-7132)
Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-3176)