The Career Section plugin for WordPress has a missing nonce guard and insufficient file path validation in its delete action. This flaw allows an attacker to forge a request and delete any file on the server. An unauthenticated user can exploit this by luring an administrator to click a crafted link, resulting in accidental removal of critical files and potential site downtime. The weakness is a path traversal error (CWE‑22).

WordPress installations running the “Career Section” plugin by shahinurislam up to version 1.6 are affected. All earlier releases are potentially vulnerable as well.

The flaw carries a CVSS v3.1 score of 8.8, indicating high severity. No EPSS score is published, and the vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires social engineering to get an administrator to trigger the delete request; the lack of authentication does not directly reduce the barrier, but the need for an admin click makes it less likely than purely remote exploits. Nevertheless, the potential impact of mass file deletion warrants vigilant mitigation.