A path traversal flaw in the WordPress WPJobBoard plugin allows an attacker to read files outside the intended directory. This weakness, identified as CWE-35, can expose sensitive documents, configuration files, or credentials, potentially leading to further compromise of the underlying system.

All WordPress sites running any version of the WPJobBoard plugin earlier than 5.11.1 are affected. The vulnerability is present in all pre‑5.11.1 releases, regardless of specific minor version numbers.

The CVSS score of 5.4 indicates moderate severity, while an EPSS score of < 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The attack likely involves submitting a specially crafted request to the plugin’s file handling functionality, inferring that user input is not properly sanitized to prevent directory traversal."