This vulnerability arises from improper neutralization of special elements in an SQL command within JoomSky’s JS Job Manager plugin for WordPress. The flaw allows an unauthenticated attacker to inject arbitrary SQL statements into the backend database. Such an injection could enable the attacker to read, modify, delete, or exfiltrate sensitive data, leading to complete compromise of the site’s data integrity and confidentiality. The weakness is identified as CWE‑89, representing a classic SQL injection attack.

WordPress sites using the JS Job Manager plugin version 2.0.2 or earlier are affected. The plugin is developed by JoomSky. No specific patch version is listed in the available data, so any release newer than 2.0.2 that addresses the issue should be used.

The CVSS score of 9.3 reflects the high severity of this flaw. The EPSS score of less than 1% indicates a low current exploitation probability, and the vulnerability is not yet listed in the CISA KEV catalog. Based on the description, the likely attack vector is through web requests to the plugin’s interface, such as job submission or search forms. Attackers would need to supply malicious input that is not properly sanitized, allowing them to execute SQL commands against the database.