The WP Job Portal WordPress plugin (versions <= 2.2.8) contains a path traversal vulnerability identified as CVE-2025-26935. This vulnerability involves the use of the '.../...//' sequence to bypass normal path restrictions, enabling PHP local file inclusion. An attacker with low privileges and no user interaction can exploit this remotely over the network. The CVSS 3.1 vector indicates network attack vector, high complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the server running the WP Job Portal plugin. This can lead to full compromise of the affected system, including unauthorized data access, modification, or denial of service. Given the high CVSS score and impact metrics, the vulnerability poses a serious risk to affected installations.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, it is recommended to restrict access to the vulnerable plugin functionality, apply web application firewall rules to detect and block path traversal attempts, and monitor for suspicious activity related to file inclusion attempts.