The WP Job Portal plugin for WordPress is vulnerable to arbitrary file deletion, which can be leveraged by authenticated attackers to achieve remote code execution.

This vulnerability is a path traversal flaw (CWE-22) located in the WPJOBPORTALcustomfields::removeFileCustom function. Authenticated users with Subscriber-level access or higher can exploit this to delete sensitive files, such as wp-config.php, potentially leading to full system compromise.

Successful exploitation of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected WordPress installation. With a CVSS score of 8.8, this high-severity flaw enables attackers to delete critical system files, which may result in complete site takeover or permanent data loss. The ability to delete configuration files provides a direct path to remote code execution, significantly increasing the potential for lateral movement within the network.

Immediate Action: Update the WP Job Portal plugin to version 2.5.0 or later immediately to incorporate the necessary file path validation fixes.

Proactive Monitoring: Monitor server access logs for suspicious requests targeting the custom fields functionality or unusual attempts to access or delete core configuration files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and restrict access to sensitive plugin functions for low-privileged user roles.

Public Exploit Available: Unknown

Given the high CVSS score and the critical nature of the impact, organizations utilizing the WP Job Portal plugin must prioritize this update. Administrators should verify the current version of the plugin across all managed WordPress environments and apply the patch to version 2.5.0 immediately to prevent unauthorized file manipulation and potential system compromise.