A missing authorization check in the Jobs for WordPress plugin allows attackers to access administrative functionality that should be restricted. The flaw is a classic broken access control vulnerability (CWE‑862). An attacker can create, edit, or delete job postings, or view sensitive application data, without authenticating or without sufficient privileges, thereby enabling unauthorized manipulation of content and deception of job seekers.

The weakness is present in the Jobs for WordPress job‑postings plugin by BlueGlass Interactive AG for all versions up to and including 2.8. Any WordPress site that has this plugin installed and has not been upgraded to a newer, patched release is affected.

The CVSS score is 7.5, indicating high impact. The EPSS score is below 1%, suggesting low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Likely attack vectors involve sending crafted HTTP requests to the plugin’s administrative endpoints, and the flaw can be exploited without elevated privileges or prior authentication. Consequently, an unauthenticated attacker could potentially manipulate job listings.