This vulnerability is caused by insufficient validation of filenames used in PHP include or require statements within the JoomSky JS Job Manager plugin. An attacker can supply a crafted parameter that leads the application to include arbitrary local files from the server’s filesystem. When a writable PHP script is included, remote code execution becomes possible; alternatively, reading protected files can expose configuration data or user information. The flaw is formally classified as CWE‑98 and carries a CVSS score of 8.1.

Any WordPress installation that uses the JoomSky JS Job Manager plugin version 2.0.2 or older is potentially vulnerable. The issue exists across all releases from the initial public version through 2.0.2. Updating to 2.0.3 or newer removes the insecure handling of include paths.

The CVSS score indicates a high potential impact if the vulnerability is exploited, but the EPSS score of 2% suggests that real‑world exploitation risk is currently low. The vulnerability is not listed in the CISA KEV catalog, implying no widespread attacks have been reported. Attackers would likely target the plugin via an HTTP request that exploits the unvalidated inclusion parameter; the exact authentication requirements are not disclosed in the description, so the risk profile remains uncertain until further details emerge.