The WordPress WP Job Portal plugin contains a missing authorization flaw that permits users to execute functions reserved for higher-level roles. Exploitation can lead to unauthorized viewing or modification of job postings, user data, or internal site administration actions, undermining confidentiality and integrity. Based on the description, it is inferred that the attack could be performed without an existing account.

The vulnerability affects all installations of WP Job Portal through version 2.4.4, including earlier releases without the fix. It applies regardless of WordPress core version and does not require additional extensions to be installed.

With a CVSS score of 7.5, the flaw is considered high severity. The EPSS indicates a very low but non‑zero probability of exploitation, and the issue is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector likely involves targeting the plugin’s web endpoints from any external IP, enabling unauthorized actions by sending crafted HTTP requests that bypass normal role checks.