CVE-2023-5906
The Job Manager & Career WordPress plugin before 1.4.4 contains a vulnerability in the Directory Listings system, which allows an unauthorized user to view and download private files of other users.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.77%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The Job Manager & Career WordPress plugin before 1.4.4 contains a vulnerability in the Directory Listings system, which allows an unauthorized user to view and download private files of other users. This vulnerability poses a serious security threat because it allows an attacker to gain access to confidential data and files of other users without their permission.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.77% probability · 53th percentile
- CISA KEV
- Not listed
- Affected
- themehigh/job manager \& career
- Source
- contact@wpscan.com
References
- https://wpscan.com/vulnerability/911d495c-3867-4259-a73a-572cd4fccddeExploit, Third Party Advisory
- https://wpscan.com/vulnerability/911d495c-3867-4259-a73a-572cd4fccddeExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.