CVE-2025-14868 - Vulnerability Analysis

Overview

Career Section WordPress plugin <= 1.6 contains a cross-site request forgery caused by missing nonce and insufficient file path validation in delete action, letting unauthenticated attackers delete arbitrary files via forged requests, exploit requires admin user interaction.

Severity & Score

Impact

Unauthenticated attackers can delete arbitrary files on the server, potentially causing data loss or service disruption.

Mitigation

Update to the latest version with nonce validation and proper file path checks.

References

• https://plugins.trac.wordpress.org/changeset/3474216/career-section
• https://www.wordfence.com/threat-intel/vulnerabilities/id/84936b68-923a-4da1-ae67-1d63d025342e?source=cve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner