What the vulnerability does
01Description
The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbitrary File Deletion in all versions up to, and including, 1.6. This is due to missing nonce validation and insufficient file path validation on the delete action in the 'appform_options_page_html' function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
Career Section versions 1.6 and earlier contain a path traversal vulnerability that allows an attacker to read, modify, or delete arbitrary files on the server. The vulnerability requires user interaction—the victim must visit a malicious link or page. An attacker can access sensitive files outside the intended directory, potentially exposing database credentials, configuration files, or other private data.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete arbitrary files on the server by traversing the file system.
Potential impact on your site
04Site Impact
Attackers can access sensitive files like wp-config.php, steal credentials, or corrupt site data without needing a user account.
Conditions required to exploit
05Prerequisites
No authentication required. Victim must click a malicious link or visit an attacker-controlled page.
Key dates
06Disclosure timeline
April 16, 2026
CVE published
April 16, 2026
Record updated
