The WP Job Portal plugin for WordPress contains an insufficient validation of filenames used in PHP include or require statements, allowing attackers to specify arbitrary local file paths. This Local File Inclusion flaw can be leveraged to read sensitive files on the server or, if a writable executable file is achievable, to execute arbitrary PHP code, resulting in remote code execution. The vulnerability is an instance of CWE‑98, an input control weakness that compromises the integrity and confidentiality of the host environment.

All releases of the WP Job Portal plugin up to and including version 2.3.1 are affected, regardless of the initial version. The plugin is distributed under the WordPress ecosystem.

The CVSS score of 8.1 classifies the flaw as high severity. The EPSS score of less than 1% indicates that, as of the latest data, exploitation attempts are uncommon, and the plugin is not listed in CISA’s KEV catalog. The attack vector is most likely via the plugin’s input handling on the web interface, where an attacker can supply a crafted filename to trigger the inclusion. Based on the description, it is inferred that an attacker with access to the plugin’s interface could trigger the flaw and potentially achieve remote code execution or unauthorized file disclosure.