CVE-2022-1166

Name of the Vulnerable Software and Affected Versions JobMonster Theme (affected versions not specified)

Description The issue allows for Directory Listing in the /wp-content/uploads/jobmonster/ folder due to the absence of a default PHP file or .htaccess file. This could potentially expose sensitive personal data, such as resumes. While secure web server configuration can prevent Directory Listing, vendors can also implement measures to reduce its likelihood.

Recommendations For the JobMonster Theme, consider adding a default PHP file or configuring an .htaccess file to prevent Directory Listing in the /wp-content/uploads/jobmonster/ folder. As a temporary workaround, restrict access to the /wp-content/uploads/jobmonster/ folder to minimize the risk of sensitive data exposure.