CVE-2025-14868

CVE-2025-14868 is a Cross-Site Request Forgery (CSRF) vulnerability in the Career Section WordPress plugin affecting all versions through 1.6. The flaw exists in the 'appform_options_page_html' function, which fails to implement proper nonce validation and path sanitization, allowing arbitrary file deletion on affected servers. This vulnerability enables unauthenticated attackers to exploit site administrators through social engineering techniques. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector requiring no special privileges and minimal complexity. Exploitation requires user interaction, specifically tricking an administrator into clicking a malicious link. However, the potential impact is severe, compromising confidentiality, integrity, and availability through the ability to delete arbitrary files on the compromised server. There is currently no evidence of active exploitation in the wild, as indicated by the vulnerability's absence from the Known Exploited Vulnerabilities (KEV) catalog and its inactive status on exploit tracking lists. The EPSS score of 0.0002 reflects the low probability of exploitation relative to other vulnerabilities. Organizations running the Career Section plugin should prioritize patching to version 1.7 or later to remediate this risk.