A missing authorization check in the WordPress WP Job Manager plugin allows an attacker to modify, delete, or create job listings beyond the intended permissions. The flaw falls under CWE‑862, leading to unauthorized access and potential manipulation of employment data, which can compromise the integrity of the job board and expose sensitive applicant information. This vulnerability can be used to tamper with listings, deface the board, or spam postings.

The issue affects all installations of Automattic WP Job Manager plugin up to and including version 2.4.0. Users running any earlier releases or unreleased versions are also covered by the fix statement in the vendor’s advisory.

The CVSS score of 5.3 indicates a medium impact, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is via the website’s authenticated user interface where role-based checks are bypassed; an attacker with legitimate credentials can exploit the flaw unless roles are properly limited.