The vulnerability allows an attacker who can send HTTP requests with a crafted "jobwp_upload_resume" parameter to inject arbitrary SQL into the plugin's query. This leads to unauthorized extraction of any data stored in the WordPress database, such as user credentials, personal information, or plugin configuration. The flaw is a classic CWE‑89 instance of SQL injection due to insufficient escaping and the use of unsanitized input in a query built with concatenation.

The flaw affects the JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin developed by mhmrajib. All releases up to and including version 2.3.9 are vulnerable. WordPress sites that have installed the plugin with those or older versions are at risk. The plugin is widely used for career pages, so many WordPress installations may be impacted.

The CVSS v3.1 base score of 7.5 indicates a high risk level. The EPSS score of 23% shows a significant likelihood of exploitation in the current month. Although it is not listed in the CISA KEV catalog, the easy identification of the vulnerable parameter and the lack of authentication requirements make the attack trivial for a determined adversary. An attacker can exploit the flaw via unauthenticated HTTP POST or GET requests to the job application endpoint, using crafted payloads to retrieve or modify database contents.