The vulnerability stems from missing authorization checks within the Job Board Manager plugin. An attacker can exploit the improperly configured access control security levels to perform actions normally restricted to privileged users. The result is the ability to manipulate job listings, user accounts, or other protected resources, potentially compromising the integrity of the website.

All installations of PickPlugins Job Board Manager version 2.1.60 or earlier are affected. The vulnerability applies to every release from the earliest documented version up through 2.1.60, irrespective of the initial release date.

The CVSS score of 5.3 indicates moderate severity; however, the EPSS score of less than 1% suggests that the likelihood of exploitation remains low under current conditions. The vulnerability is not listed in the CISA KEV catalog. The attack is likely to be carried out via the web interface of the affected WordPress site, allowing an unauthenticated or low‑privileged user to elevate privileges if the site is not otherwise hardened.