The vulnerability is a cross‑site request forgery flaw that lets an attacker craft a malicious HTML form which, when an administrator visits the page, submits a request to administrative endpoints such as job.jobenforcedelete without validating a CSRF token. The attacker can perform state‑changing actions like deleting job postings or altering component configuration, thereby compromising the integrity and availability of the Joomla site.

The flaw resides in the Joomsky:JS Jobs component version 1.2.0 for Joomla. Administrators who have access to the component’s administrative interface are potentially affected if the component is installed and enabled.

The CVSS score of 6.9 indicates a moderate to high severity. Because the exploit requires an authenticated administrator to visit a crafted page, it is a targeted attack but does not provide remote code execution. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attacker would need to entice an administrator to load a malicious page, after which the forged request submits without token validation, allowing the attacker to change or delete content.