What is the CVSS score of CVE-2025-14293?

CVE-2025-14293 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2025-14293

MEDIUM

Path Traversal (CWE-22)

2025-12-11 security@wordfence.com

Path Traversal WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Dec 11, 2025 - 21:15 nvd

MEDIUM 6.5

DescriptionCVE.org

The WP Job Portal plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.4.0 via the 'downloadCustomUploadedFile' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

AnalysisAI

WP Job Portal plugin for WordPress allows authenticated attackers with Subscriber-level access to read arbitrary files on the server through path traversal in the 'downloadCustomUploadedFile' function, potentially exposing sensitive configuration files, database credentials, or other confidential data. The vulnerability affects all versions up to and including 2.4.0, with CVSS 6.5 reflecting the high confidentiality impact but low attack complexity and requirement only for basic authenticated access.

Technical ContextAI

The vulnerability stems from inadequate input validation and path canonicalization in the 'downloadCustomUploadedFile' function within the WP Job Portal plugin's custom field module (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). The function fails to properly sanitize user-supplied file path parameters before using them in file operations, allowing attackers to traverse the filesystem using relative path components (e.g., '../../../etc/passwd') to access files outside the intended upload directory. This is a classic path traversal vulnerability commonly found in file download/transfer functionality when basename() or similar checks are insufficient or bypassed. The plugin is a WordPress extension (CPE scope: wp-plugins/wp-job-portal), meaning it runs within the WordPress application context with access to server filesystem permissions granted to the web server process.

Affected ProductsAI

WP Job Portal plugin for WordPress versions 2.4.0 and earlier. The vulnerability resides in the 'downloadCustomUploadedFile' function within modules/customfield/model.php, as evidenced by source references to tags 2.3.9 and 2.4.1 in the official WordPress plugin repository. The plugin is distributed via the WordPress plugin directory (CPE: cpe:2.3:a:wp-job-portal:wp-job-portal:*:*:*:*:*:wordpress:*:*). Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/6dfcd264-39e3-44af-8e0e-5c35734524d0) provides additional context and vulnerability tracking.

RemediationAI

Site administrators should immediately upgrade WP Job Portal to version 2.4.1 or later, which includes fixes to properly validate and sanitize file path parameters in the downloadCustomUploadedFile function. Upgrade instructions are available through the WordPress plugin dashboard (Plugins > Updates) or via the official plugin repository. Until an update can be deployed, implement network-level access restrictions to limit file download functionality to trusted user roles, and consider disabling the custom upload feature temporarily if available through plugin settings. Additionally, review and restrict user registration permissions to prevent unauthenticated account creation, as Subscriber-level access is sufficient to exploit this vulnerability. Web server filesystem permissions should be audited to ensure the web server process cannot read sensitive files outside the intended wp-content/uploads directory. Monitor web server logs for suspicious '../' patterns or requests to modules/customfield/ endpoints.