JS Job Manager < 2.0.3 - Unauthenticated Privilege Escalation via Post Installation Wizard
- ID
- WPSEC-2026-0384
- Plugin
- JS Job Manager (js-jobs)
- Affected
- all versions before 2.0.3
- Remediation
- Update to 2.0.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- JS Job Manager on WPSec AttackSurface
- Fix released
- Published
Description
The JS Job Manager plugin for WordPress is vulnerable to privilege escalation via the post installation wizard in all versions up to, but not including, 2.0.3. The wizard's save handler performed no capability check and wrote any submitted setting name, including the WordPress role assigned to newly registered employers and job seekers, and the wizard's administrative screens, together with the nonce they create, could be rendered on the front end for logged-out visitors. This makes it possible for unauthenticated attackers to change the plugin's settings and have new self-registered accounts created with the administrator role.
References
- https://wpsec.com/vuln/WPSEC-2026-0384/
- https://plugins.svn.wordpress.org/js-jobs/tags/2.0.3/
- https://wordpress.org/plugins/js-jobs/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS