Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Automattic/WP-Job-Manager

              trunk @ ed8d2c8
            

Fixes

CVEs

HIGH

Peak severity

45.9%

Coverage

Highlights

Auth Bypass: 14 prior fixes. Scrutinize any change in this area.

includes/class-wp-job-manager-post-types.php: most-fixed (8 issues). Treat as high-risk during review.

27 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes address missing capability/nonce checks on job editing, submission, and dashboard actions, allowing unauthorized users to create, modify, or exceed limits on listings.

Information Disclosure: REST API endpoints repeatedly leaked raw or rendered listing content (title, content, excerpt) to users denied view capability, and HEAD requests bypassed the gate.

Access Control Bypass / Information Disclosure: Search, feeds, AJAX, and oEmbed endpoints repeatedly exposed restricted listings due to missing or bypassable view/browse capability gates.