This vulnerability is a path traversal flaw that allows an attacker to download any file accessible to the web server, potentially exposing configuration files, credentials, or other sensitive data. The flaw stems from insufficient validation of file paths in the WP Job Portal plugin, enabling a malicious user to craft requests to traverse directories. The weakness is classified as CWE‑22, which typically permits information disclosure and, if combined with other weaknesses, could lead to code execution or privilege escalation.

WordPress sites that have the wp-job-portal plugin installed at any version from the first release through version 2.3.2 inclusive. The plugin is distributed by wpjobportal under the name WP Job Portal and is commonly bundled with WordPress installations that provide job posting functionality.

The CVSS score of 7.5 indicates high severity, with a low EPSS score of less than 1 % suggesting that exploitation is not currently common. The vulnerability is not listed in the CISA KEV catalog, which further reduces its immediate risk. The attack vector is inferred to be remote, accessible over the web via the plugin’s file download interface, and does not require authentication according to the description. An attacker can exploit the flaw by constructing a malicious URL that manipulates the file path parameter to reference files outside the intended download directory.