The vulnerability is an Insecure Direct Object Reference that allows an attacker to bypass the intended authorization controls by providing a user‑controlled key in API requests. This permits reading and potentially modifying job listings or details that the user should not have access to, leading to data exposure and corruption.

The issue affects the JobBoard Job listing WordPress plugin from themeglow, for all releases through version 1.2.8, inclusive. No specific sub‑versions are listed but any installation running 1.2.8 or earlier is vulnerable.

The CVSS score of 4.9 indicates moderate risk, and the EPSS score of <1% reflects a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attack vectors are most likely through crafted HTTP requests to the plugin’s endpoints, using a manipulated identifier to target unprivileged data. Because the issue stems from incorrectly configured access‑control levels, many authenticated users could unintentionally gain unauthorized access if they manipulate the key.