CVE-2025-14868

Career Section <= 1.6 - Cross-Site Request Forgery to Arbitrary File Deletion

Published Apr 16, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbitrary File Deletion in all versions up to, and including, 1.6. This is due to missing nonce validation and insufficient file path validation on the delete action in the 'appform_options_page_html' function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

Analysis

Technical impact

The Career Section plugin for WordPress has a missing nonce guard and insufficient file path validation in its delete action. This flaw allows an attacker to forge a request and delete any file on the server. An unauthenticated user can exploit this by luring an administrator to click a crafted link, resulting in accidental removal of critical files and potential site downtime. The weakness is a path traversal error (CWE‑22).

Affected Systems

WordPress installations running the “Career Section” plugin by shahinurislam up to version 1.6 are affected. All earlier releases are potentially vulnerable as well.

Risk and Exploitability

The flaw carries a CVSS v3.1 score of 8.8, indicating high severity. No EPSS score is published, and the vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires social engineering to get an administrator to trigger the delete request; the lack of authentication does not directly reduce the barrier, but the need for an admin click makes it less likely than purely remote exploits. Nevertheless, the potential impact of mass file deletion warrants vigilant mitigation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

shahinurislam

Career Section

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.6

No data.

Vendor Product Versions

Shahinurislam

Career Section

Version	Status	Scheme	Platform
`[0,1.6]`	affected	generic	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Career Section plugin to the latest version, which removes the CSRF and path traversal flaw.
If an update is not immediately possible, disable or uninstall the plugin to prevent the attack vector.
Enable all plugin administrators to use two‑factor authentication and reinforce safe logging to detect suspicious file deletion attempts.

Generated by OpenCVE AI on April 16, 2026 at 08:49 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.420% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://plugins.trac.wordpress.org/changeset/3474216/career-section
https://www.wordfence.com/threat-intel/vulnerabilities/id/84936b68-923a-4da1-ae67-1d63d025342e?source=cve

History

Apr 16, 2026 1:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 16, 2026 9:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Shahinurislam Shahinurislam career Section Wordpress Wordpress wordpress
Vendors & Products		Shahinurislam Shahinurislam career Section Wordpress Wordpress wordpress

Apr 16, 2026 7:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbitrary File Deletion in all versions up to, and including, 1.6. This is due to missing nonce validation and insufficient file path validation on the delete action in the 'appform_options_page_html' function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Title		Career Section <= 1.6 - Cross-Site Request Forgery to Arbitrary File Deletion
Weaknesses		CWE-22
References		https://plugins.trac.wordpress.org/changeset/3474216/career-section https://www.wordfence.com/threat-intel/vulnerabilities/id/84936b68-923a-4da1-ae67-1d63d025342e?source=cve
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`