JobZilla WordPress Theme: Privilege escalation for Subscribers
Summary
The JobZilla - Job Board WordPress Theme up to and including version 2.2 contains a privilege escalation flaw (CWE-266, Incorrect Privilege Assignment). An attacker with a low-privilege Subscriber account can gain administrator-level control over the affected WordPress site, with high impact on confidentiality, integrity and availability. The attacker must first obtain a Subscriber account, which job boards with open self-registration make easier. No fixed version has been confirmed yet.
Affected
- DexignZone JobZilla - Job Board WordPress Theme, versions up to and including 2.2
- Required privilege: Subscriber account
Fixed in
Unknown. No fixed version has been confirmed by the vendor or Patchstack. Do not assume that version 2.3 fixes this issue without written confirmation.
Workaround
- No vendor-published mitigation found.
- Disable open user registration if the job board does not need it.
- Review existing Subscriber accounts for unexpected or elevated roles.
- Monitor for newly created administrator or Editor accounts.
Exploitation
- Not listed in CISA KEV; CISA SSVC: exploitation none, automatable no, technical impact total.
- Patchstack rates the issue high priority and expects exploitation, but no public proof of concept was found.
- EPSS reported at 0.34%.
Our recommendation
- Confirm the installed theme version and whether user registration is open.
- Ask DexignZone or Patchstack which version fixes CVE-2026-39775.
- Apply the workarounds above until a fix is confirmed.
- Consider Patchstack virtual patching if available.
- Check Subscriber and administrator accounts regularly and keep verified backups.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-39775 patchstack.com
- ThemeForest JobZilla product page themeforest.net
- HOL CVE-2026-39775 hol.org
- Strix CVE-2026-39775 www.strix.ai
- GitHub issue tracker entry (EPSS, KEV status) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:26.
Original description (NVD)
Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.