Jobscout EUVD-2026-11810

The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N profile indicates a remotely exploitable vulnerability with low complexity and no authentication barrier, making it trivial to discover and exploit programmatically. The integrity impact (I:L) suggests attackers can modify data but not achieve confidentiality breaches or system availability impact. The absence of KEV (Known Exploited Vulnerability) status and publicly disclosed proof-of-concept code suggests limited active exploitation in the wild, though the simplicity of the attack vector (network-accessible, no authentication needed) means exploitation likelihood remains high once disclosed. Given the plugin's prevalence in WordPress job board implementations, the real-world priority should exceed the moderate 5.3 CVSS score—this is a high-priority issue for organizations running JobScout, despite the restricted impact scope.

An unauthenticated attacker discovers that JobScout's REST API endpoint for updating job postings lacks authorization checks. By sending a crafted HTTP POST request to /wp-json/jobscout/v1/jobs/{id} with modified job details (such as description, salary, or contact information), the attacker successfully modifies job listings without any authentication. The attacker could inject malicious content, redirect applicants to phishing pages, or delete legitimate job postings, causing data integrity issues and reputational damage to the job board operator. No proof-of-concept code is required—basic familiarity with WordPress REST API patterns and HTTP tooling is sufficient for exploitation.