CVE-2026-39660
Missing Authorization in WP Job Manager ≤ 2.4.1 Enables Unauthorized Access
Publication date: 2026-04-08
Last updated on: 2026-04-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| automattic | wp_job_manager | to 2.4.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-39660 is a broken access control vulnerability in the WordPress WP Job Manager plugin versions up to and including 2.4.1.
The issue arises from missing authorization, authentication, or nonce token checks in certain plugin functions, which allows unauthenticated users to perform actions that normally require higher privileges.
This vulnerability falls under the OWASP Top 10 category A1: Broken Access Control.
How can this vulnerability impact me? :
This vulnerability allows unauthenticated users to perform privileged actions within the WP Job Manager plugin, potentially leading to unauthorized changes or access.
Although the CVSS severity score is 5.3, indicating a low priority and low impact threat, it can still be exploited in mass campaigns targeting many websites.
No official patch is currently available, so immediate mitigation involves updating the plugin to a non-vulnerable version if possible or seeking help from hosting providers or web developers.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is related to missing authorization checks in the WP Job Manager WordPress plugin, allowing unauthenticated users to perform privileged actions.
Detection typically involves checking the version of the WP Job Manager plugin installed on your WordPress site to see if it is version 2.4.1 or earlier, as these versions are vulnerable.
You can detect the plugin version by accessing your WordPress admin dashboard or by running commands on your server to inspect the plugin files.
- Use WP-CLI to check the plugin version: wp plugin list | grep wp-job-manager
- Manually check the plugin version in the plugin's main PHP file, usually located at wp-content/plugins/wp-job-manager/wp-job-manager.php, by looking for the Version header.
Since the vulnerability involves broken access control, monitoring for unusual or unauthorized actions performed by unauthenticated users on endpoints related to WP Job Manager could also help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the WP Job Manager plugin to a non-vulnerable version if such an update is available.
If no official patch or update is available, you should seek assistance from your hosting provider or web developers to implement custom access control measures or temporary workarounds.
Additionally, consider restricting access to the affected plugin's endpoints by using web application firewalls or server-level access controls to limit unauthenticated requests.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a broken access control issue that allows unauthenticated users to perform actions requiring higher privileges, which could potentially lead to unauthorized access to sensitive data.
Such unauthorized access risks may impact compliance with standards and regulations like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive information.
However, the provided information does not explicitly state the direct effects on compliance with these regulations.