The vulnerability is a CSRF flaw present in Hossni Mubarak’s JobWP plugin version 2.3.9 and earlier. It allows an attacker to craft a malicious request that an authenticated site visitor will unknowingly submit, potentially executing privileged actions on the WordPress site. Because the flaw relies on the user’s authenticated session, the impact is the ability to alter data, submit job postings, or perform other actions as if the victim were the site admin.

The flaw affects the WordPress JobWP plugin supplied by Hossni Mubarak. All installations using plugin version 2.3.9 or earlier are potentially vulnerable.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% signals a very low probability of exploitation. The issue is not listed in CISA’s KEV catalog. Exploitation requires a victim to be logged into the site and to visit a malicious page, and the attacker can trigger the vulnerable action without needing additional privileges or advanced techniques.