JobZilla EUVD-2026-93025

Requires an authenticated WordPress account at Subscriber (low-privilege) level on a site running the JobZilla - Job Board theme version 2.2 or earlier (PR:L in the vector). The practical enabling condition is open user self-registration, which is typical for job-board sites where candidates/employers create accounts - this makes acquiring the needed Subscriber account trivial in most deployments. No user interaction is needed (UI:N) and the attack is network-reachable (AV:N). Limiting factors: sites with registration disabled, or that do not expose the vulnerable theme, require the attacker to first obtain a valid low-privilege credential; exploitation is also constrained to installations of this specific theme at or below version 2.2.

This is a genuine, actionable priority for anyone running the JobZilla theme, though not an emergency on the scale of an unauthenticated RCE. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) is internally consistent with the CWE-266 (Incorrect Privilege Assignment) classification and the 'Subscriber Privilege Escalation' description: a network-reachable, low-complexity flaw requiring only a low-privilege authenticated account (PR:L) and no user interaction, yielding full confidentiality/integrity/availability impact once a Subscriber escalates to a higher role (effectively site takeover). The signals do NOT indicate active exploitation: KEV status is not present (not CISA-listed), no public POC is referenced, and no EPSS score was supplied in the input, so exploitation probability cannot be quantified. The one source is a Patchstack advisory, a reputable WordPress-focused vendor. Net: real risk because job-board themes routinely allow open Subscriber self-registration, which directly satisfies the PR:L prerequisite - but severity is tempered by the authentication requirement and the absence of any confirmed in-the-wild activity. EPSS and KEV data are missing rather than low, so 'low real risk' cannot be concluded; treat as a patch-soon item, especially on sites with open registration.

An attacker self-registers (or uses an existing low-privilege Subscriber account) on a site running JobZilla <= 2.2, then abuses the theme's incorrect privilege assignment to grant their own account elevated capabilities (e.g., administrator), achieving full site compromise. No user interaction or victim is needed and the account can be obtained through normal open registration. No public exploit code is referenced in the available data, so this reflects the attack path implied by the CVSS vector (AV:N/AC:L/PR:L) rather than a confirmed published POC.