CVE-2024-11712 is a vulnerability in the WP Job Portal – AI-Powered Recruitment System WordPress plugin that permits unauthorized access to user resume files. The root cause is the absence of a capability check in the getResumeFileDownloadById() function, enabling unauthenticated attackers to download resumes belonging to other users. This issue affects all versions up to and including 2.2.2. The vulnerability is categorized as CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor) and has a CVSS 3.1 base score of 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

The vulnerability allows unauthorized disclosure of private personal information contained in user resumes. There is no impact on system integrity or availability. The exposure of sensitive personal data could lead to privacy violations and potential misuse of the information by attackers. No known exploits in the wild have been reported as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is indicated in the provided data, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the plugin or disabling it may reduce exposure. Avoid exposing the affected functionality to unauthenticated users.