Jobs for WordPress EUVD-2026-93261

Requires an authenticated Contributor-level (PR:L) WordPress account on a site running Jobs for WordPress version 2.8.2 or earlier; the vulnerable path-traversal file-deletion code path must be reachable, which it is in default plugin installations. Limiting factors: exploitation is impossible without a valid contributor account, so sites that disable open user registration and tightly control low-privilege roles are substantially protected; no user interaction and no high privilege is needed beyond that account, and the attack is remotely reachable over the network.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, base 7.7) describes a network-reachable, low-complexity flaw requiring low privileges and no user interaction, with a scope change and high availability impact but no confidentiality or integrity impact. The PR:L metric confirms this is authenticated exploitation - consistent with the 'Contributor' role named in the description, meaning an attacker needs a valid low-privileged WordPress account rather than anonymous access. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified from this dataset. This is a real but conditional risk: the contributor-account prerequisite meaningfully limits mass, unauthenticated exploitation, so it ranks below a true pre-auth RCE, yet sites that permit open user registration or have many contributor accounts face a credible path to destructive file deletion (e.g. deleting wp-config.php to force reinstallation and potential takeover). Note a minor signal tension: the impact is scored purely as A:H (C:N/I:N) even though arbitrary file deletion can plausibly carry integrity consequences - the Patchstack scoring treats it as availability-only, which is defensible but worth verifying.

An attacker registers or obtains a Contributor-level account on a WordPress site running Jobs for WordPress <= 2.8.2, then abuses a plugin file-handling endpoint vulnerable to path traversal (CWE-22) to supply a crafted relative path and delete files outside the intended directory. By deleting a critical file such as wp-config.php, the attacker can disrupt the site or trigger a reinstallation flow that may lead to full compromise. No public exploit code was identified in the provided data.