Jobify WordPress Theme Missing Authorization Vulnerability Allowing Unauthenticated Image Upload and AI Image Generation

A vulnerability exists in the Jobify - Job Board WordPress Theme, in all versions through 4.2.7, due to a lack of proper capability checks in the 'download_image_via_ai' and 'generate_image_via_ai' functions. This flaw enables unauthenticated attackers to send web requests from the application to upload image files and to generate AI images using the site's OpenAI key.

Impact

Exploitation of this vulnerability could lead to unauthorized image uploads and the generation of AI images using the victim site's OpenAI credentials.

Remediation

Users are advised to update the theme to version 4.2.8 or a newer patched version.