This vulnerability is a missing authorization flaw that allows attackers to bypass the job manager's access controls. The flaw is rooted in Incorrectly Configured Access Control Security Levels and is classified as CWE-862. An attacker who successfully exploits this weakness can perform job‑management actions that are normally restricted to privileged roles, potentially exposing sensitive job data or manipulating listings.

The issue affects the JoomSky JS Job Manager plugin installed in WordPress environments. All instances running version 2.0.2 or earlier are impacted.

The CVSS score of 5.3 indicates a moderate risk, while the EPSS score of < 1% shows that exploit attempts are rare. The vulnerability is not listed in the CISA KEV catalog, which means no widespread exploitation has been observed. The likely attack vector is web‑based, wherein an attacker sends crafted HTTP requests to the plugin’s endpoints to maneuver through the broken access controls. No additional prerequisites are noted beyond standard access to the site’s web interface.