Apply the resume viewing capability settings to the REST API, feeds, archives, oEmbed and sitemaps.
Apply the browse capability setting to the resume listing request.
Limit resume files to the uploads directory and downloads to published resumes. Uploaded resume files now get a random suffix in their file names.
Check resume ownership and sign-in when applying with a resume.
Check submission permissions before processing uploads, and require a valid edit key for guest resume edits.
Restrict shortcode expansion in resume content, and tighten resume approval and candidate dashboard actions.
Template change: apply-with-resume.php now includes a nonce field (wp_nonce_field( 'apply-with-resume-' . absint( $post->ID ), '_wpjm_nonce' )). Theme overrides keep working, as the field is added when it is missing, and administrators see a notice naming the file until the line is added to it.