CVE-2026-39752: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in BlueGlass Interactive AG Jobs for WordPress

This vulnerability (CVE-2026-39752) in Jobs for WordPress (<= 2.8.2) is a path traversal flaw (CWE-22) that permits a contributor-level user to delete arbitrary files. The flaw arises from insufficient validation of file pathnames, enabling traversal outside intended directories. The CVSS 3.1 score of 7.7 reflects network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and a scope change with impact limited to availability (file deletion). No known exploits in the wild or vendor patches are currently documented.

An attacker with contributor privileges can delete arbitrary files on the server, causing denial of service or disruption of service availability. There is no direct impact on confidentiality or integrity according to the CVSS vector. This can affect the stability and reliability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor privileges carefully and monitor for suspicious activity related to file deletions. Avoid granting contributor access to untrusted users.