A vulnerability in the WP Job Portal WordPress plugin allows an authenticated user with at least subscriber-level access to invoke the 'downloadCustomUploadedFile' function and read any file on the server. The flaw results from unchecked file path handling, enabling the attacker to retrieve sensitive or confidential contents. This directly compromises the confidentiality of server files and can expose private data, configuration files or credentials.

The flaw affects installations of WP Job Portal – AI‑Powered Recruitment System for Company or Job Board website, versions 2.4.0 and earlier. The plugin is distributed under the WP Job Portal name and is typically installed within a WordPress site.

The CVSS score of 6.5 categorises this issue as moderate severity, with an EPSS score of less than 1 % indicating a low probability of exploitation at present. It is not listed in the CISA KEV catalog. An attacker must first log in as a user with subscriber or higher role and then send a crafted request to the endpoint; the lack of file‑path validation enables arbitrary file read from the server.