The issue is a missing authorization flaw that allows an attacker to gain unauthorized access to functionality controlled by the WP Job Portal plugin. This missing authorization (CWE‑862) means any user with access to the site can exploit incorrect access controls and reach privileged features. The vulnerability can expose protected data or enable actions that should be restricted to administrators. The description confirms that the flaw is detectable through incorrect configuration of security levels within the plugin.

The affected product is the Ahmad WP Job Portal WordPress plugin. All releases up to and including version 2.7.1 are affected. Sites that have the plugin installed in any capacity, from the earliest versions through 2.7.1, are at risk.

The CVSS base score of 4.3 indicates moderate severity. The EPSS score is not available, so the current exploitation probability is unknown, but the vulnerability is not listed in CISA KEV, which suggests no known exploitation activity yet. Likely attack vectors involve remote interaction with a WordPress site that has the plugin installed, where an attacker could trigger the broken access controls by using any user or unprivileged role. The absence of a listed proof‑of‑concept does not preclude the possibility of exploitation, but the risk is primarily limited to the plugin's ability to bypass role checks.