The flaw is an improper control of the filename used in a PHP include/require statement, which permits a local file inclusion vulnerability in the JoomSky JS Job Manager plugin. This weakness, identified as CWE‑98, can allow an attacker to read arbitrary local files on the server, and in certain configurations could lead to execution of code or other compromises of confidentiality, integrity, or availability.

WordPress sites that have installed the JoomSky JS Job Manager plugin in any version from the first release through 2.0.2 are affected. The plugin is identified as "JS Job Manager" for WordPress, and the vulnerability applies to all PHP environments where the plugin is enabled.

The CVSS score of 8.8 signals a high severity risk, and the EPSS score below 1% indicates that exploitation is currently considered unlikely but not impossible. The vulnerability is listed as not part of the CISA KEV catalog, meaning no known public exploit has been documented. Based on the description, it is inferred that the likely attack vector is through a remotely accessible input that influences the filename parameter used in the include/require statement, enabling local file inclusion. This scenario could potentially be extended to remote code execution in certain server configurations.