PT-2026-28149 · WordPress · Wp Job Portal+1

Daroo · CVE-2026-4758 · Publicado 2026-03-25 · Atualizado 2026-03-26

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Job Portal versions prior to 2.4.9

Description The WP Job Portal plugin for WordPress is susceptible to arbitrary file deletion. This is due to inadequate file path validation within the WPJOBPORTALcustomfields::removeFileCustom function. Authenticated attackers with Subscriber-level access or higher can delete arbitrary files on the server. Deletion of specific files, such as wp-config.php, could lead to remote code execution. The removeFileCustom function is the point of failure.

Recommendations Update WP Job Portal to a version later than 2.4.9.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-4758

Produtos afetados

Wp Job Portal

Wordpress

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-4758 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/e96f31e0-4b2e-4ea1-a3e5-fd7452a2fea9?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.5.0/includes/classes/customfields.php?rev=3490490#L1558 · Nota
• https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.4.9/includes/classes/customfields.php#L1558 · Nota
• https://twitter.com/CVEnew/status/2037137784788467872 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2036971370572308503 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2036967166293995816 · Publicação no Twitter