PHP CVE-2026-4758

WordPress installation with WP Job Portal plugin versions up to 2.4.9 enabled. Attacker requires authenticated WordPress account with Subscriber role or higher. No user interaction needed. Vulnerable function: WPJOBPORTALcustomfields::removeFileCustom allows path traversal to delete arbitrary files.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-accessible exploitation with low attack complexity, requiring only low-privilege authentication (Subscriber-level) with no user interaction. However, the EPSS score of 0.25% at the 48th percentile suggests that exploitation probability in real-world environments is relatively low despite the high CVSS score of 8.8. The technical impact is severe-successful exploitation enables complete system compromise through arbitrary file deletion leading to RCE. The attack is automatable once credentials are obtained, but the prerequisite of authenticated access (even at the lowest privilege level) creates a barrier to widespread exploitation. With no confirmed active exploitation (not in CISA KEV) and no public POC at analysis time, this represents a high-severity vulnerability requiring prioritization for patching but not an imminent mass-exploitation event. Organizations running this plugin should prioritize remediation based on whether they allow open user registration with Subscriber-level access.

An attacker registers a Subscriber-level account on a WordPress site running the vulnerable WP Job Portal plugin (or compromises existing low-privilege credentials through credential stuffing or phishing). The attacker crafts a malicious HTTP request to the removeFileCustom function, injecting path traversal sequences (e.g., ../../../../wp-config.php) to target the WordPress configuration file. Upon successful deletion of wp-config.php, the attacker triggers the WordPress installation routine, creates a new administrative account, and achieves complete control over the website and potentially the underlying server.