The vulnerability is a broken access control flaw in the WordPress JobScout theme, which results from missing authorization checks. An attacker who can access the theme’s functionality may be able to perform actions that the user has not been intended to perform, such as creating, editing, or deleting job postings and viewing sensitive data. The weakness corresponds to CWE-862, which identifies the failure to enforce required authorizations.

WordPress sites that deploy the raratheme:JobScout theme with a version of 1.1.7 or earlier are vulnerable. This includes all installations of the JobScout theme dated from the earliest releases up to and including 1.1.7.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and no widespread exploits are publicly documented. The likely attack vector is through the WordPress web interface where the theme’s panels are accessible; an attacker would need to reach the pages that invoke the compromised functions, which could be possible even without additional authentication if the site is misconfigured.