CVE-2025-26935 HIGH

CVE-2025-26935: WordPress WP Job Portal plugin <= 2.2.8 - Local File Inclusion vulnerability

Vendor Wpjobportal

Product WP Job Portal

Weakness CWE-35

Published February 25, 2025

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Path Traversal: '.../...//' vulnerability in wpjobportal WP Job Portal wp-job-portal allows PHP Local File Inclusion.This issue affects WP Job Portal: from n/a through <= 2.2.8.

Explanation of Vulnerability in Simple Terms

02Summary

WP Job Portal versions 2.2.8 and earlier contain a vulnerability that allows authenticated users with low privileges to read sensitive data, modify site content, or disrupt service. The vulnerability requires network access and high attack complexity. Site administrators should update to a version newer than 2.2.8 as soon as possible.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify content, or disrupt the site's availability.

Potential impact on your site

04Site Impact

Authenticated users can access confidential information, alter job postings or site data, or cause service disruptions.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the site.

Key dates

06Disclosure timeline

February 25, 2025 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-26935 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/35.html AskarLabs — CWE-35 write-up Path Traversal (Multiple Leading Dots)

Related vulnerabilities