Read the docs
TI-2023-05438 Aliases CVE-2023-5906GHSA-p7pg-xwv6-5rhh

Job Manager & Career < 1.4.4 - Directory listing to Sensitive Data Exposure

Priority LOW 34Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The Job Manager & Career WordPress plugin before 1.4.4 contains a vulnerability in the Directory Listings system, which allows an unauthorized user to view and download private files of other users. This vulnerability poses a serious security threat because it allows an attacker to gain access to confidential data and files of other users without their permission.

Why it matters now

EPSS 0.00767 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Job Manager & Career (Unknown): 1.4.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownJob Manager & Careerbefore 1.4.41.4.4Patch availableCNA
  • Job Manager & Career VendorUnknown Affected before 1.4.4 Fixed in 1.4.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:themehigh:job_manager_\&_career:*:*:*:*:*:wordpress:*:*before 1.4.4VulnerableThemeHigh
  • cpe:2.3:a:themehigh:job_manager_\&_career:*:*:*:*:*:wordpress:*:* Versions before 1.4.4 Vulnerable ·ThemeHigh

Remediation

  • Fix · CNA Job Manager & Career (Unknown) Fixed in 1.4.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-5906
  2. 2026-10-03 Alias added: GHSA-p7pg-xwv6-5rhh

References

Exploit 1

  • TI-2023-28197 Cross-site request forgery in ThemeHigh Job Manager & Career – Manage job board listings… CVSS 3.1CRITICAL 9.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences