The vulnerability allows a malicious actor to delete files from the file system by exploiting an insufficient validation of the path parameter in the deletion routine. If the attacker can trigger the deletion request, any file within the web root or subdirectories can be removed, potentially causing loss of critical application data or configuration files, and may lead to denial of service or further compromise if the application is restarted with a different configuration.

WordPress installation running the Jobs for WordPress plugin version 2.8.2 or older, provided by BlueGlass Interactive AG. The plugin is commonly installed on public‑facing sites that use the WordPress Jobs feature.

The CVSS score of 7.7 reflects a high impact and moderate exploitability. The EPSS score is <1% (approximately 0.0045), indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited documented exploitation. The likely attack vector is web‑based through the plugin’s delete endpoint, which may be exposed to users with the Contributor role or, if misconfigured, to unauthenticated users. Exploitation requires the ability to send crafted requests to the deletion route, thus the risk is higher on installations that allow contributors to delete files or do not restrict the endpoint.