The Jobify WordPress theme suffers from a missing capability check (CWE-862) in its AI-related functions 'download_image_via_ai' and 'generate_image_via_ai'. This flaw permits unauthenticated users to invoke these functions, enabling unauthorized data access and modification. Attackers can upload images and generate AI images leveraging the site's OpenAI key, potentially leading to unauthorized use of resources and data exposure. The vulnerability affects all versions up to and including 4.2.7. No patch or vendor advisory is currently provided.

The vulnerability allows unauthenticated attackers to bypass authorization controls, resulting in unauthorized data access and modification. Attackers can upload image files and generate AI images using the site's OpenAI key, which may lead to misuse of the site's resources and potential data exposure. The CVSS score of 6.5 reflects a medium severity impact with low complexity and no privileges required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functions if possible, and monitor for unusual activity related to image uploads and AI image generation. Avoid exposing the OpenAI key publicly and consider disabling the vulnerable features temporarily if feasible.