An attacker can upload arbitrary files via the JoomSky JS Job Manager plugin and place a web shell on the server, allowing remote code execution. The vulnerability originates from the lack of validation of the uploaded file type, which matches CWE‑434. Compromise of confidentiality, integrity, and availability can follow if the attacker succeeds in executing malicious code.

The JoomSky JS Job Manager WordPress plugin is affected for all versions up to and including 2.0.2, as the vendor indicates the issue applies from the earliest release onward to 2.0.2. No later versions are listed as vulnerable.

The CVSS score of 10 denotes a critical risk, yet the EPSS score below 1% indicates a very low current exploitation probability, and the issue is not listed in the CISA KEV catalog. Attackers would likely exploit the plugin’s file‑upload interface, as the description mentions unrestricted upload of dangerous payloads. Specific authentication requirements are not provided, but it is inferred that the vulnerability is exploitable via the web interface, potentially requiring only a user with permission to post jobs with the plugin.