Jobzilla Job Board Wordpress Theme
Monthly
Subscriber-level privilege escalation in the JobZilla - Job Board WordPress theme through version 2.2 allows an authenticated low-privilege user to elevate their permissions, with high impact to confidentiality, integrity, and availability (CVSS 8.8). The attack is network-reachable, low-complexity, and requires no user interaction; because the CVSS vector includes PR:L, the attacker must be authenticated, and in typical job-board deployments with open self-registration obtaining a Subscriber account is trivial, while sites with registration disabled still require a valid low-privilege credential first. No public exploit identified at time of analysis, so this is an actionable priority for affected sites but not an unauthenticated emergency.
Subscriber-level privilege escalation in the JobZilla - Job Board WordPress theme through version 2.2 allows an authenticated low-privilege user to elevate their permissions, with high impact to confidentiality, integrity, and availability (CVSS 8.8). The attack is network-reachable, low-complexity, and requires no user interaction; because the CVSS vector includes PR:L, the attacker must be authenticated, and in typical job-board deployments with open self-registration obtaining a Subscriber account is trivial, while sites with registration disabled still require a valid low-privilege credential first. No public exploit identified at time of analysis, so this is an actionable priority for affected sites but not an unauthenticated emergency.