CVE-2025-14868: 
WordPress vulnerability analysis and mitigation

CVE-2025-14868 is a Cross-Site Request Forgery (CSRF) vulnerability chained with Path Traversal and Arbitrary File Deletion in the Career Section plugin for WordPress. It affects all versions up to and including 1.6, and was published on April 16, 2026. The flaw allows unauthenticated attackers to delete arbitrary files on the server by tricking a site administrator into clicking a malicious link. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Wordfence).

The root cause is twofold: missing nonce validation (CWE-352) and insufficient file path validation (CWE-22) in the delete action of the appform_options_page_html function within the Career Section plugin. Because no WordPress nonce is checked before processing the delete request, an attacker can forge a cross-site request that passes a path-traversal sequence (e.g., ../../) as the file parameter, causing the server to delete files outside the intended plugin directory. Exploitation requires social engineering — the attacker must trick an authenticated administrator into triggering the forged request, such as by visiting a malicious page or clicking a crafted link (GitHub Advisory, Wordfence).

Successful exploitation allows an unauthenticated attacker (via a tricked administrator) to delete arbitrary files on the web server, including critical WordPress core files, configuration files (e.g., wp-config.php), or other sensitive data. This can result in complete site compromise, data corruption, loss of service availability, or facilitate further attacks such as forcing WordPress into a reinstallation state that exposes database credentials. All three security pillars — confidentiality, integrity, and availability — are rated High impact (GitHub Advisory, Wordfence).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.038% per GitHub Advisory), placing it in the 12th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Career Section plugin version ≤ 1.6 using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Craft malicious request: Construct a forged HTTP POST request targeting the plugin's admin page that invokes the appform_options_page_html delete action, including a path-traversal payload (e.g., ../../wp-config.php) as the file parameter.
3. Embed in social engineering lure: Wrap the forged request in an HTML page (e.g., an auto-submitting form) or disguise it as a link in a phishing email targeting the site administrator.
4. Trick administrator: Deliver the malicious link or page to a logged-in WordPress administrator, causing their browser to automatically submit the forged request with their authenticated session cookies.
5. Achieve arbitrary file deletion: The server processes the request without nonce validation, traverses the path, and deletes the targeted file — potentially wp-config.php or core WordPress files — leading to site disruption or a forced reinstallation that may expose credentials (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing unexpected POST requests to the admin page (/wp-admin/options-general.php?page=career-section or similar) with file path parameters containing traversal sequences (../, %2e%2e%2f, or encoded variants).
• File System: Unexpected absence of critical files such as wp-config.php, WordPress core files, or plugin/theme files; file system integrity monitoring alerts for deleted files outside the plugin's own directory.
• Logs: PHP error logs or WordPress debug logs showing file deletion operations or errors referencing paths outside the plugin's upload/data directory.
• Network: Referrer headers in access logs pointing to external or unknown domains on admin POST requests, indicating a CSRF origin (GitHub Advisory, Wordfence).

Update the Career Section WordPress plugin to a version newer than 1.6, which includes the fix applied in changeset 3474216 (WordPress Trac). As interim measures, restrict administrator access to trusted users only, implement a Web Application Firewall (WAF) rule to block path traversal patterns in POST parameters, and use a WordPress security plugin that enforces CSRF protections. Administrators should also conduct security awareness training to reduce susceptibility to phishing and social engineering attacks (Wordfence, GitHub Advisory).

Wordfence reported the vulnerability as part of their weekly WordPress vulnerability report for April 13–19, 2026, and assigned it a High severity rating (Wordfence Blog). The vulnerability was noted in CISA's weekly vulnerability bulletin for the week of April 13, 2026 (CISA Bulletin). Social media activity was limited, with brief mentions on Mastodon by security accounts such as RedPacketSecurity and TheHackerWire shortly after disclosure.