CVE-2015-6668

This issue is about a WordPress plugin that can accidentally let outsiders find and open files it shouldn’t. The attacker “guesses” file locations in the website’s uploads area, then reads CV-related files if the guesses hit.

Analogy: it’s like leaving a filing cabinet unlocked and giving a stranger the file-cabinet layout—then the stranger tries many drawer numbers until the right drawer opens.

This matters if your business website runs WordPress and has the “Job Manager” plugin installed at version 0.7.25 or older. Because the problem can be triggered remotely, you’re exposed when the vulnerable plugin is reachable through your public website.

This is an AMBER issue: it can expose sensitive CV files to remote attackers, and the weakness is designed for guessing file locations. While CISA KEV does not list it, press attention is rising, so you should reduce exposure now rather than waiting.

1. Confirm whether you’re affected

• In your WordPress admin area, go to the Plugins page and locate “Job Manager”. Record the exact installed version.
• If it is earlier than 0.7.25, you are in the affected range.

2. Apply the safest fix available

• If your plugin source provides an update to 0.7.25 or later, upgrade immediately.
• If you cannot upgrade because no verified fixed version is available for your environment, disable the plugin and remove it until a verified update is possible.

3. Validate that exposure is reduced

• After upgrading/disabling, monitor web server logs for repeated requests that look like automated attempts to access files under WordPress uploads directories.
• If you have a web application firewall (WAF) or similar protection, ensure it is not blocking the normal site, but consider tightening rules around suspicious direct file access attempts (coordinate with your IT/vendor).

4. Temporary workaround (if patching is delayed)

• Disable/remove the “Job Manager” plugin to stop the vulnerable code path.
• If you must keep the plugin enabled temporarily, ensure you limit public reachability where possible (e.g., restrict access to job/CV features), but the primary goal is to remove the vulnerable plugin.

KEV / exploitation notes

• This CVE is not listed in the CISA KEV set.
• The provided information does not include confirmed, in-the-wild exploitation details or a verified patch beyond the stated “before 0.7.25” vulnerable range.

What to monitor going forward

• Elevated rates of requests aimed at files in WordPress uploads related to CVs.
• Any alerts about suspicious downloads or spikes in 404/403 responses that suggest brute-force probing.

Severity and type: The weakness is described as an insecure direct object reference (CWE-200) that can enable unauthorized file reads. Mechanism: remote attackers can exploit the plugin to read arbitrary CV files by brute-forcing guesses of the WordPress upload directory structure.

Affected versions: job manager versions before 0.7.25 are reported vulnerable.

Exploitation status: CISA KEV does not list this vulnerability. The findings include a detection template only (no proof of exploitation details) and indicate rising press attention.

Fix status: The findings do not provide specific patch/upgrade details beyond the vulnerable range and the target version 0.7.25; no separate verified patch card/version specifics were included.

EPSS (private/public note): A prediction is present, but per the findings guidance it should not be treated as confirmed exploitation and is not included in public-facing owner messaging.