WP Job Portal <= 2.4.0 - Authenticated (Subscriber+) Arbitrary File Read
CVE-2025-14293

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
WP Job Portal – Ai-powered Recruitment System For Company Or Job Board Website
Vendor
CVE Published:
11 December 2025

What is CVE-2025-14293?

The WP Job Portal plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.4.0 via the 'downloadCustomUploadedFile' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Affected Version(s)

WP Job Portal – AI-Powered Recruitment System for Company or Job Board website * <= 2.4.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-job-portal/...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Long Nguyen
JSON
.
CVE-2025-14293 : Arbitrary File Read Vulnerability in WP Job Portal Plugin by WordPress