Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbitrary File Deletion in all versions up to, and including, 1.6. This is due to missing nonce validation and insufficient file path validation on the delete action in the 'appform_options_page_html' function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2025-14868 Cross-Site Request Forgery Leading to Arbitrary File Deletion in Career Section Plugin WordPress 1.6 https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-14868
Post summary
This post announces CVE-2025-14868, a CSRF vulnerability in the WordPress Career Section Plugin 1.6 that enables arbitrary file deletion, and links to a vulnerability detail page.
CVE-2025-14868 The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbitrary File Deletion in all versions up to, and i… https://www.cve.org/CVERecord?id=CVE-2025-14868
Post summary
The Career Section WordPress plugin is affected by CVE-2025-14868, a CSRF vulnerability that allows path traversal and arbitrary file deletion.
⚠️ HIGH — CVE-2025-14868 The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbit… CVSS 8.8 Full analysis → https://sec.kaitan.id/cves/CVE-2025-14868 #WordPress #CyberSecurity #InfoSec
Post summary
The CVE-2025-14868 vulnerability in the WordPress Career Section plugin is a high‑severity CSRF leading to path traversal, with CVSS 8.8, and is described in an analysis link, but no PoC, exploit, or patch information is provided.