CVE-2025-14293
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2Tags
Description
The WP Job Portal plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.4.0 via the 'downloadCustomUploadedFile' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Analysis
WP Job Portal plugin for WordPress allows authenticated attackers with Subscriber-level access to read arbitrary files on the server through path traversal in the 'downloadCustomUploadedFile' function, potentially exposing sensitive configuration files, database credentials, or other confidential data. The vulnerability affects all versions up to and including 2.4.0, with CVSS 6.5 reflecting the high confidentiality impact but low attack complexity and requirement only for basic authenticated access.
Technical Context
The vulnerability stems from inadequate input validation and path canonicalization in the 'downloadCustomUploadedFile' function within the WP Job Portal plugin's custom field module (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). The function fails to properly sanitize user-supplied file path parameters before using them in file operations, allowing attackers to traverse the filesystem using relative path components (e.g., '../../../etc/passwd') to access files outside the intended upload directory. This is a classic path traversal vulnerability commonly found in file download/transfer functionality when basename() or similar checks are insufficient or bypassed. The plugin is a WordPress extension (CPE scope: wp-plugins/wp-job-portal), meaning it runs within the WordPress application context with access to server filesystem permissions granted to the web server process.
Affected Products
WP Job Portal plugin for WordPress versions 2.4.0 and earlier. The vulnerability resides in the 'downloadCustomUploadedFile' function within modules/customfield/model.php, as evidenced by source references to tags 2.3.9 and 2.4.1 in the official WordPress plugin repository. The plugin is distributed via the WordPress plugin directory (CPE: cpe:2.3:a:wp-job-portal:wp-job-portal:*:*:*:*:*:wordpress:*:*). Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/6dfcd264-39e3-44af-8e0e-5c35734524d0) provides additional context and vulnerability tracking.
Remediation
Site administrators should immediately upgrade WP Job Portal to version 2.4.1 or later, which includes fixes to properly validate and sanitize file path parameters in the downloadCustomUploadedFile function. Upgrade instructions are available through the WordPress plugin dashboard (Plugins > Updates) or via the official plugin repository. Until an update can be deployed, implement network-level access restrictions to limit file download functionality to trusted user roles, and consider disabling the custom upload feature temporarily if available through plugin settings. Additionally, review and restrict user registration permissions to prevent unauthenticated account creation, as Subscriber-level access is sufficient to exploit this vulnerability. Web server filesystem permissions should be audited to ensure the web server process cannot read sensitive files outside the intended wp-content/uploads directory. Monitor web server logs for suspicious '../' patterns or requests to modules/customfield/ endpoints.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today