{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14868", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-18T03:30:13.946Z", "datePublished": "2026-04-16T07:39:49.576Z", "dateUpdated": "2026-04-16T07:39:49.576Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-16T07:39:49.576Z"}, "affected": [{"vendor": "shahinurislam", "product": "Career Section", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbitrary File Deletion in all versions up to, and including, 1.6. This is due to missing nonce validation and insufficient file path validation on the delete action in the 'appform_options_page_html' function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Career Section <= 1.6 - Cross-Site Request Forgery to Arbitrary File Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84936b68-923a-4da1-ae67-1d63d025342e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3474216/career-section"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ivan Cese"}], "timeline": [{"time": "2025-12-17T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-04-15T18:53:02.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbitrary File Deletion in all versions up to, and including, 1.6. This is due to missing nonce validation and insufficient file path validation on the delete action in the 'appform_options_page_html' function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link."}], "id": "CVE-2025-14868", "lastModified": "2026-04-16T08:16:26.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-16T08:16:26.773", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3474216/career-section"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84936b68-923a-4da1-ae67-1d63d025342e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.6]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Career Section", "source": "cna", "vendor": "shahinurislam"}, "product": "career_section", "vendor": "shahinurislam"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T08:49:36.384028+00:00", "value": {"mitigation_remediation": ["Update the Career Section plugin to the latest version, which removes the CSRF and path traversal flaw.", "If an update is not immediately possible, disable or uninstall the plugin to prevent the attack vector.", "Enable all plugin administrators to use two\u2011factor authentication and reinforce safe logging to detect suspicious file deletion attempts."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary File Deletion"}, "threat_synthesis": {"affected_systems": "WordPress installations running the \u201cCareer Section\u201d plugin by shahinurislam up to version 1.6 are affected. All earlier releases are potentially vulnerable as well.", "description_and_impact": "The Career Section plugin for WordPress has a missing nonce guard and insufficient file path validation in its delete action. This flaw allows an attacker to forge a request and delete any file on the server. An unauthenticated user can exploit this by luring an administrator to click a crafted link, resulting in accidental removal of critical files and potential site downtime. The weakness is a path traversal error (CWE\u201122).", "risk_and_exploitability": "The flaw carries a CVSS v3.1 score of 8.8, indicating high severity. No EPSS score is published, and the vulnerability is not currently listed in CISA\u2019s KEV catalog. Exploitation requires social engineering to get an administrator to trigger the delete request; the lack of authentication does not directly reduce the barrier, but the need for an admin click makes it less likely than purely remote exploits. Nevertheless, the potential impact of mass file deletion warrants vigilant mitigation."}}}}, "created": "2026-04-16T09:00:05.288119+00:00", "updated": "2026-04-16T09:11:35.804249+00:00", "vendors": ["shahinurislam", "shahinurislam$PRODUCT$career_section", "wordpress", "wordpress$PRODUCT$wordpress"]}