CVE-2025-14868 is a path traversal vulnerability in the Career Section WordPress plugin caused by improper limitation of a pathname to a restricted directory (CWE-22). The vulnerability arises from missing nonce validation and inadequate file path validation in the delete action of the 'appform_options_page_html' function, allowing unauthenticated attackers to delete arbitrary files via CSRF. The CVSS 3.1 base score is 8.8, reflecting network attack vector, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to delete arbitrary files on the server hosting the vulnerable WordPress plugin. This can lead to denial of service, data loss, and potential further compromise depending on which files are deleted. The attack requires tricking an authenticated administrator to perform the action, but no direct authentication is needed by the attacker. The high CVSS score indicates severe impact on confidentiality, integrity, and availability.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, administrators should avoid clicking on untrusted links and consider restricting administrative access or disabling the vulnerable plugin if possible to reduce risk.