The WP Job Portal plugin allows authenticated users with Subscriber level or higher to call the removeFileCustom method. Because the method does not validate the file path, an attacker can specify any server path and delete files. Removing critical files such as wp-config.php can compromise the entire WordPress installation, allowing code execution, defacement, or data loss.

Environments running WordPress with the WP Job Portal plugin on any version up to and including 2.4.9 are affected. The vulnerability is exploitable by any role that the plugin grants through the subscriber role, which is common for users who apply for jobs or post resumes. Versions 2.5.0 and later have the issue fixed.

The vulnerability carries a CVSS score of 8.8, classifying it as high severity. No EPSS value is available, and the flaw is not listed in CISA's KEV catalog. Attackers need valid subscriber credentials, but once authenticated, the path validation weakness permits deletion of arbitrary files, which can lead directly to remote code execution or denial of service. The attack vector is inferred to be local via legitimate user access, but the outcome can have system–wide impact so it must be treated with urgency.