The vulnerability allows an attacker to bypass authentication by using an alternate path or channel within the NooTheme Jobica Core plugin. Once authentication is bypassed, the attacker can gain unauthorized access to administrator accounts, enabling full control over the WordPress site, including the ability to manipulate content, settings, or install additional malware. The weakness is classified as CWE-288, indicating an authentication abuse scenario.

WordPress installations that utilize the NooTheme Jobica Core plugin version 1.4.2 or any earlier release are affected. Site administrators and developers deploying these versions must be aware that their sites could be compromised if the plugin is not updated.

With a CVSS score of 9.8, this flaw represents a critical vulnerability, though the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, which indicates no publicly known exploits at the time of reporting. Attacks would require identifying the vulnerable endpoint, sending a crafted request to trigger the authentication bypass, and then establishing control over the compromised account. The potential impact ranges from site defacement to complete takeover, affecting both confidentiality and integrity of site data.