Core Bug: Massive logo duplication bloat server space
-
Hi WP Job Manager Team,
I am writing this public report to expose a critical design flaw in how WP Job Manager handles company logo uploads via the frontend submission form. This issue has bloated our Media Library with over 20,000 duplicate images and is actively magnifying database corruption.
Please note that this website does NOT use any caching plugins, server caching, or CDNs. This is a pure database and core logic flaw within WP Job Manager.
THE CORE ISSUE: INFINITE FILE DUPLICATION
Every single time an employer submits a new job listing and includes their logo, the plugin processes the upload as a brand-new file in the WordPress Media Library. Even if the exact same company has already uploaded the exact same file 40 times before, it creates endless duplicates like logo-1 and logo-2. The architectural flaw is that the submission form logic handles the company logo payload as an isolated file upload instance instead of checking if the Company Entity or User Meta already holds a valid, identical Attachment ID to reuse.THE CASCADE FAILURE: ORPHANED METADATA AND BROKEN IMAGES
When we attempted to manually clean up this mess by deleting just one of the 40 identical logo duplicates from the WordPress Admin Media section, the entire system collapsed for that company. Deleting the attachment physically removes the file and destroys its corresponding ID in wp_posts. However, the database logic ties the metadata of all previous and current job posts for that company in a way that breaking one reference invalidates the rest. Even though 39 identical copies of the logo still exist in the Media Library, they are completely ignored by the plugin logic.THE EMPLOYER FRONTEND TRAP: AUTOMATIC BROKEN IMAGES
When the affected company attempts to post a new job, the frontend form still displays their company logo visually on the screen. The system allows them to complete the submission without any warnings. However, the moment they click Publish, the plugin attempts to map the new job post to the missing or destroyed Attachment ID. The result is that the job listing is published instantly with a corrupted or broken image icon. The employer has no idea during the submission process, and our job board gets flooded with broken image errors.THE RISK: SERVER VULNERABILITY (POTENTIAL DoS)
Leaving this unaddressed means any malicious user could automate job submissions with the same logo file, generating tens of thousands of server files and completely filling up disk space, leading to a server-side Denial of Service due to storage exhaustion.EXPECTED RESOLUTION (SMART ASSET MANAGEMENT):
The plugin must implement a strict verification check during the submission process based on the unique asset file rather than just the user account, supporting employers who manage multiple distinct businesses:- Case A (Identical Asset): If an employer submits a job with a logo file that has already been uploaded and exists in the Media Library, the plugin should reuse that existing Attachment ID instead of creating a duplicate file.
- Case B (New Unique Asset): If the employer uploads a genuinely different logo file (for a different business or a rebranding), the plugin should process it as a new upload, without affecting or deleting other distinct logos previously uploaded by that user.
We look forward to a technical response regarding how your team plans to patch this core asset-handling flaw. Thank you.
-
There’s a fix in https://github.com/Automattic/WP-Job-Manager/pull/3064
Copy includes/forms/class-wp-job-manager-form-submit-job.php from the zip file there and overwrite it in your install. That will stop further dupes happening. It won’t clean up the duplicates though.
Test it by submitting a job and uploading a new logo. That one won’t be caught, but repeat it and the dupe will not be uploaded.
You must be logged in to reply to this topic.
