What is the CVSS score of EUVD-2026-16052?

EUVD-2026-16052 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by EUVD-2026-16052?

Organizations using WP Job Portal plugin versions 2.4.9 and earlier face potential website compromise through authenticated attackers with subscriber-level access who can delete critical WordPress…

How to fix or mitigate EUVD-2026-16052?

Within 24 hours: Audit active subscribers on all WordPress instances running WP Job Portal and document their business justification; disable the plugin on all affected installations pending patch availability or implement network-level restrictions. Within 7 days: Restrict subscriber role access to WordPress environments where possible; implement audit logging for file deletion events in WordPress core and plugin directories. Within 30 days: Monitor vendor advisories for WP Job Portal patched version release; conduct access control review of all subscriber and contributor accounts across WordPress estate.

PHP EUVD-2026-16052

| CVE-2026-4758 HIGH

Path Traversal (CWE-22)

2026-03-25 Wordfence

WordPress PHP RCE Path Traversal

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 23:47 euvd

EUVD-2026-16052

Analysis Generated

Mar 25, 2026 - 23:47 vuln.today

CVE Published

Mar 25, 2026 - 23:26 nvd

HIGH 8.8

DescriptionCVE.org

The WP Job Portal plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'WPJOBPORTALcustomfields::removeFileCustom' function in all versions up to, and including, 2.4.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

AnalysisAI

Authenticated attackers with Subscriber-level access can delete arbitrary files on WordPress servers running WP Job Portal plugin versions up to 2.4.9, enabling remote code execution by removing critical files like wp-config.php. The vulnerability stems from insufficient file path validation in the removeFileCustom function. EPSS exploitation probability is 0.25% (48th percentile), indicating low predicted real-world exploitation likelihood, though the CVSS score of 8.8 reflects high potential impact when successfully exploited. No public exploit identified at time of analysis.

Technical ContextAI

WP Job Portal is an AI-powered recruitment system plugin for WordPress (CPE: cpe:2.3:a:wpjobportal:wp_job_portal_-_ai-powered_recruitment_system_for_company_or_job_board_website:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The flaw exists in the WPJOBPORTALcustomfields::removeFileCustom function within includes/classes/customfields.php, where user-supplied file paths are not properly validated before deletion operations. This allows attackers to use directory traversal sequences (e.g., ../../) to escape intended directories and target arbitrary files on the server filesystem. The PHP-based plugin processes file deletion requests from authenticated users without sufficient sanitization, enabling exploitation through standard HTTP requests to the WordPress application.

RemediationAI

Upgrade WP Job Portal to version 2.5.0 or later, where the vulnerability has been addressed as evidenced by code changes visible at https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.5.0/includes/classes/customfields.php?rev=3490490#L1558. Review the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e96f31e0-4b2e-4ea1-a3e5-fd7452a2fea9?source=cve for additional details. Until patching is completed, consider temporarily disabling custom file upload functionality in the plugin, restricting user registration to prevent Subscriber-level account creation, or implementing web application firewall rules to detect and block path traversal attempts in file deletion requests. Audit server logs for suspicious file operations and verify integrity of critical WordPress files like wp-config.php.