WordPress Plugin Zero-Day: CSRF to Arbitrary File Deletion

The National Vulnerability Database (NVD) has flagged a critical vulnerability, CVE-2025-14868, affecting the Career Section plugin for WordPress. This zero-day allows for Cross-Site Request Forgery (CSRF) that can escalate to Path Traversal and Arbitrary File Deletion. All versions up to and including 1.6 are impacted.

According to NVD, the root cause lies in the plugin’s ‘appform_options_page_html’ function, specifically due to missing nonce validation and insufficient file path validation on the delete action. This combination creates a dangerous vector where an unauthenticated attacker could delete arbitrary files on the server. The catch? It requires tricking a site administrator into clicking a malicious link or performing another forged request. While user interaction is needed, the impact is severe, earning a CVSS score of 8.8 (HIGH). This is a prime example of how seemingly minor validation oversights can open the door to catastrophic server compromise.