The WP Job Portal plugin for WordPress contains a Path Traversal flaw that allows attackers to craft URLs ending with sequences like '../..//', leading the PHP runtime to include local files. This Local File Inclusion can enable reading sensitive configuration or web server files and, if the included files contain PHP code, arbitrary code execution on the server. The weakness is identified as CWE-22 and CWE-35.

Affected systems are installations of the wpjobportal WP Job Portal plugin version 2.2.8 and earlier, which is commonly used on WordPress sites to manage job listings. The vulnerability exists prior to the release of version 2.2.9, so any site still running 2.2.8 or older is vulnerable.

The CVSS score of 7.5 indicates a high severity that could lead to remote code execution if the attacker can supply a code file. The EPSS score of less than 1% shows that currently the likelihood of exploitation is low, and the vulnerability is not yet listed in the CISA KEV catalog. However, if an attacker can gather the correct traversal payload and the server allows PHP execution of arbitrary local files, the impact could be significant. The attack vector is likely a remote HTTP request to the vulnerable plugin endpoint.