CVE-2025-14293: WP Job Portal <= 2.4.0 - Authenticated (Subscriber+) Arbitrary File Read
The WP Job Portal plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.4.0 via the 'downloadCustomUploadedFile' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14293?
CVE-2025-14293 is classified as a moderate severity vulnerability due to its potential for arbitrary file read access.
How do I fix CVE-2025-14293?
To fix CVE-2025-14293, update the WP Job Portal plugin to version 2.4.1 or later.
Who is affected by CVE-2025-14293?
CVE-2025-14293 affects all versions of the WP Job Portal plugin up to and including 2.4.0.
What can an attacker do with CVE-2025-14293?
An authenticated attacker with Subscriber-level access can exploit CVE-2025-14293 to read arbitrary files on the server.
When was CVE-2025-14293 disclosed?
CVE-2025-14293 was disclosed in 2025, impacting the security of WordPress sites using the vulnerable plugin.