CVE-2025-1310: Jobs for WordPress <= 2.7.11 - Authenticated (Subscriber+) Arbitrary File Read
The Jobs for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.11 via the 'jobpostingsgetfile' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1310?
CVE-2025-1310 is rated as high severity due to its potential for unauthorized access to sensitive files.
How do I fix CVE-2025-1310?
To fix CVE-2025-1310, update the Jobs for WordPress plugin to version 2.7.12 or later.
Who is affected by CVE-2025-1310?
CVE-2025-1310 affects authenticated users with Subscriber-level access and above.
What kind of attack is possible with CVE-2025-1310?
CVE-2025-1310 allows authenticated attackers to exploit directory traversal to read sensitive file contents.
What versions of the Jobs for WordPress plugin are vulnerable to CVE-2025-1310?
All versions of the Jobs for WordPress plugin up to and including 2.7.11 are vulnerable to CVE-2025-1310.