CVE-2025-14868

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14868", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-18T03:30:13.946Z", "datePublished": "2026-04-16T07:39:49.576Z", "dateUpdated": "2026-04-16T12:52:42.034Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-16T07:39:49.576Z"}, "affected": [{"vendor": "shahinurislam", "product": "Career Section", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbitrary File Deletion in all versions up to, and including, 1.6. This is due to missing nonce validation and insufficient file path validation on the delete action in the 'appform_options_page_html' function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Career Section <= 1.6 - Cross-Site Request Forgery to Arbitrary File Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84936b68-923a-4da1-ae67-1d63d025342e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3474216/career-section"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ivan Cese"}], "timeline": [{"time": "2025-12-17T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-04-15T18:53:02.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T12:52:12.214575Z", "id": "CVE-2025-14868", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T12:52:42.034Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14868", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-16T12:52:12.214575Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T12:52:29.687Z"}}], "cna": {"title": "Career Section <= 1.6 - Cross-Site Request Forgery to Arbitrary File Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Ivan Cese"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "shahinurislam", "product": "Career Section", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-17T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-04-15T18:53:02.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84936b68-923a-4da1-ae67-1d63d025342e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3474216/career-section"}], "descriptions": [{"lang": "en", "value": "The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbitrary File Deletion in all versions up to, and including, 1.6. This is due to missing nonce validation and insufficient file path validation on the delete action in the 'appform_options_page_html' function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-16T07:39:49.576Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14868", "state": "PUBLISHED", "dateUpdated": "2026-04-16T12:52:42.034Z", "dateReserved": "2025-12-18T03:30:13.946Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-16T07:39:49.576Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Career Section", "vendor": "shahinurislam", "versions": [{"lessThanOrEqual": "1.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbitrary File Deletion in all versions up to, and including, 1.6. This is due to missing nonce validation and insufficient file path validation on the delete action in the 'appform_options_page_html' function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Career Section para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n en sitios cruzados lo que lleva a salto de ruta y eliminaci\u00f3n arbitraria de archivos en todas las versiones hasta la 1.6, inclusive. Esto se debe a la falta de validaci\u00f3n de nonce y a una validaci\u00f3n insuficiente de la ruta de archivo en la acci\u00f3n de eliminaci\u00f3n en la funci\u00f3n 'appform_options_page_html'. Esto hace posible que atacantes no autenticados eliminen archivos arbitrarios en el servidor a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-14868", "lastModified": "2026-10-07T09:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14868", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T12:52:12.214575Z", "version": "2.0.3"}}]}, "published": "2026-04-16T08:16:26.773", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3474216/career-section"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84936b68-923a-4da1-ae67-1d63d025342e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.6]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Career Section", "source": "cna", "vendor": "shahinurislam"}, "product": "career_section", "vendor": "shahinurislam"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T08:49:36.384028+00:00", "value": {"mitigation_remediation": ["Update the Career Section plugin to the latest version, which removes the CSRF and path traversal flaw.", "If an update is not immediately possible, disable or uninstall the plugin to prevent the attack vector.", "Enable all plugin administrators to use two\u2011factor authentication and reinforce safe logging to detect suspicious file deletion attempts."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary File Deletion"}, "threat_synthesis": {"affected_systems": "WordPress installations running the \u201cCareer Section\u201d plugin by shahinurislam up to version 1.6 are affected. All earlier releases are potentially vulnerable as well.", "description_and_impact": "The Career Section plugin for WordPress has a missing nonce guard and insufficient file path validation in its delete action. This flaw allows an attacker to forge a request and delete any file on the server. An unauthenticated user can exploit this by luring an administrator to click a crafted link, resulting in accidental removal of critical files and potential site downtime. The weakness is a path traversal error (CWE\u201122).", "risk_and_exploitability": "The flaw carries a CVSS v3.1 score of 8.8, indicating high severity. No EPSS score is published, and the vulnerability is not currently listed in CISA\u2019s KEV catalog. Exploitation requires social engineering to get an administrator to trigger the delete request; the lack of authentication does not directly reduce the barrier, but the need for an admin click makes it less likely than purely remote exploits. Nevertheless, the potential impact of mass file deletion warrants vigilant mitigation."}}}}, "created": "2026-04-16T09:00:05.288119+00:00", "updated": "2026-04-16T09:11:35.804249+00:00", "vendors": ["shahinurislam", "shahinurislam$PRODUCT$career_section", "wordpress", "wordpress$PRODUCT$wordpress"]}