The WP Job Portal plugin for WordPress (versions up to 2.3.2) contains an improper limitation of a pathname to a restricted directory, commonly known as a path traversal vulnerability. This allows remote attackers to access files outside the designated directory structure by manipulating file path inputs. The vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS 3.1 base score is 7.5, reflecting high confidentiality impact but no integrity or availability impact. No official patch or remediation information is currently provided.

Successful exploitation could allow an unauthenticated remote attacker to read sensitive files on the server that should be restricted, potentially leading to information disclosure. There is no indication of impact on data integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin or disabling it if possible to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.