Back
CVE-2023-4933
WP Job Openings < 3.4.3 - Sensitive Data Exposure via Directory Listing
Medium5.3EPSS 0.65%
- Published
- Updated
- Reserved
- Assigned by
- WPScan
Description
The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job applications, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.65% · top 49% of all CVEs (6 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.
Weakness
- CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
- CWE-552 (opens in a new tab)All about CWE-552 and its CVEs
Affected products
- affected < 3.4.3
References (1)
- https://wpscan.com/vulnerability/882f6c36-44c6-4273-81cd-2eaaf5e81fa7 (opens in a new tab)exploitvdb-entrytechnical-descriptionx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-4933)Record last updated .