What is the CVSS score of CVE-2026-52716?

CVE-2026-52716 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.4%.

WorkScout-Core CVE-2026-52716

Q: Which versions of WorkScout-Core are affected by CVE-2026-52716?

Unauthenticated arbitrary file deletion in the WorkScout-Core WordPress plugin (versions <= 1.7.11) allows any remote attacker to delete files on the underlying server without credentials.

MEDIUM

Path Traversal (CWE-22)

2026-06-17 Patchstack

WordPress Path Traversal Wordpress Plugin Workscout Core Purethemes

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

9.1 CRITICAL

Arbitrary file deletion with no prerequisites can remove wp-config.php or core files, causing complete integrity and availability loss; C:N holds as deletion alone does not read data.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:53 vuln.today

DescriptionCVE.org

Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions.

AnalysisAI

Unauthenticated arbitrary file deletion in the WorkScout-Core WordPress plugin (versions <= 1.7.11) allows any remote attacker to delete files on the underlying server without credentials. The flaw stems from a path traversal weakness (CWE-22) in a file-handling endpoint that fails to sanitize user-supplied input before constructing filesystem paths. Exploitation requires no authentication, no user interaction, and no special configuration, meaning every publicly reachable WordPress installation running this plugin version is exposed; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

WorkScout-Core (CPE: cpe:2.3:a:purethemes:workscout-core) is a WordPress plugin by PureThemes that provides job board and recruitment functionality. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal), meaning the plugin accepts a filename or path parameter from unauthenticated HTTP requests and passes it to a filesystem deletion function without canonicalizing or validating that the resolved path remains within an expected directory. By injecting traversal sequences (e.g., '../../../'), an attacker can escape the intended upload or cache directory and target arbitrary files accessible to the web server process, including critical WordPress files such as wp-config.php or core PHP files.

RemediationAI

No vendor-released patch version has been independently confirmed in the available data; the Patchstack disclosure at https://patchstack.com/database/wordpress/plugin/workscout-core/vulnerability/wordpress-workscout-core-plugin-1-7-11-arbitrary-file-deletion-vulnerability should be monitored for a fixed release. As an immediate compensating control, deactivate or uninstall the WorkScout-Core plugin entirely until a patched version is confirmed - this fully eliminates the attack surface but disables job board functionality. If deactivation is not operationally feasible, restrict access to the WordPress installation's public-facing endpoints at the web server or firewall layer to trusted IP ranges, accepting the trade-off of reduced site accessibility. Additionally, harden the web server process account so it lacks write or delete permissions to files outside the WordPress uploads directory, limiting the blast radius of any successful path traversal. Ensure wp-config.php file permissions are set to 400 or 440 to reduce exploitability of sensitive file access.