The WPJobBoard plugin contains a flaw that allows attackers to upload a malicious file that is then executed on the server. The lack of CSRF protection lets an attacker send a crafted request from a victim’s browser, giving the attacker full remote code execution. The weakness is a Cross‑Site Request Forgery issue, CWE‑352.

Any WordPress site that has the WPJobBoard plugin installed. Versions prior to 5.11.1 are affected, as the vulnerability exists in all earlier releases of the plugin. Users of older plugin versions are therefore at risk.

The vulnerability carries a CVSS score of 9.6, placing it in the critical category. The EPSS score is below 1%, indicating that recent exploitation incidents are scarce but not impossible. The flaw is not currently listed in the CISA KEV catalog. The most probable attack vector involves a CSRF request sent from a logged‑in administrator’s session, allowing the attacker to upload a web shell without the user’s knowledge.