CVE-2025-14868
CSRF in WordPress Career Section Plugin Allows Arbitrary File Deletion
Publication date: 2026-04-16
Last updated on: 2026-04-16
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wpjobboard | career_section | to 1.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Career Section plugin for WordPress has a vulnerability known as Cross-Site Request Forgery (CSRF) that leads to Path Traversal and Arbitrary File Deletion. This occurs because the plugin lacks nonce validation and proper file path validation in the delete action within the 'appform_options_page_html' function.
As a result, an unauthenticated attacker can trick a site administrator into performing an action, such as clicking a malicious link, which then allows the attacker to delete arbitrary files on the server.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized deletion of files on your server. Since an attacker can delete arbitrary files by tricking an administrator, it can lead to loss of critical data, disruption of website functionality, and potential compromise of the server environment.
The CVSS score of 8.8 indicates a high severity, meaning the vulnerability is easy to exploit remotely without privileges but requires user interaction, and it can cause high confidentiality, integrity, and availability impacts.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthenticated attackers to delete arbitrary files on the server by exploiting a Cross-Site Request Forgery (CSRF) flaw combined with path traversal. Such unauthorized file deletion can lead to data loss, potential exposure of sensitive information, and disruption of service.
While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, the ability for attackers to delete arbitrary files could impact the confidentiality, integrity, and availability of data. This may result in non-compliance with regulations that require protection of personal and sensitive data, timely breach notification, and maintaining data integrity.