The Jobs for WordPress plugin (blueglassch Job Postings) contains a CWE-22 directory traversal vulnerability in versions up to 2.7.11. An authenticated attacker with at least Subscriber privileges can manipulate the 'job_postings_get_file' parameter to access files outside the intended directory scope. This improper limitation of pathname allows reading arbitrary files on the server, potentially exposing sensitive data. The vulnerability is network exploitable without user interaction and does not affect integrity or availability, only confidentiality.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to read arbitrary files on the server. This can lead to disclosure of sensitive information stored on the server, impacting confidentiality. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict Subscriber-level access where possible and consider additional access controls to limit exposure.