What’s Vulnerable › Vulnerabilities

CVE-2022-2544: Ninja Job Board < 1.3.3 - Resume Disclosure via Directory Listing

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-08-22 · updated 2026-06-17
• Weakness: CWE-425

Description

The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes.

Affected products

• Ninja Job Board – Ultimate WordPress Job Board Plugin: before 1.3.3 — fixed in 1.3.3

How to fix

Upgrade to a fixed version: Ninja Job Board – Ultimate WordPress Job Board Plugin 1.3.3. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/2758420/ninja-job-board/trunk/includes/Classes/File/FileHandler.php?old=2126467&old_path=ninja-job-board%2Ftrunk%2Fincludes%2FClasses%2FFile%2FFileHandler.php
• https://wpscan.com/vulnerability/a9bcc68c-eeda-4647-8463-e7e136733053
• https://plugins.trac.wordpress.org/changeset/2758420/ninja-job-board/trunk/includes/Classes/File/FileHandler.php?old=2126467&old_path=ninja-job-board%2Ftrunk%2Fincludes%2FClasses%2FFile%2FFileHandler.php
• https://wpscan.com/vulnerability/a9bcc68c-eeda-4647-8463-e7e136733053

Get alerted when CVE-2022-2544 or the next vulnerability affects your stack