critical advisory March 26, 2026

WP Job Portal Plugin Arbitrary File Deletion Vulnerability (CVE-2026-4758)

The WP Job Portal plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation, allowing authenticated attackers with subscriber-level access or higher to delete arbitrary files, potentially leading to remote code execution.

Triage facts

Severity: Critical
Sources: 2 public sources
Freshness: PublishedMar 26, 00:16 UTC
Detection: 2 rules

The WP Job Portal plugin for WordPress versions up to and including 2.4.9 is susceptible to an arbitrary file deletion vulnerability (CVE-2026-4758). The vulnerability stems from insufficient file path validation within the WPJOBPORTALcustomfields::removeFileCustom function. Authenticated attackers with Subscriber-level access or higher can exploit this flaw to delete arbitrary files on the server. Successful exploitation allows attackers to delete critical files such as wp-config.php…

Detection coverage 2

Detect WP Job Portal Arbitrary File Deletion Attempt

critical

Detects attempts to exploit CVE-2026-4758 by monitoring for suspicious requests to the 'removeFileCustom' function in the WP Job Portal plugin.

sigma tactics: execution, persistence, privilege_escalation techniques: T1547.001 sources: webserver, linux

Detect wp-config.php Deletion via Web Server Logs

critical

Detects attempts to delete the wp-config.php file by monitoring for corresponding web server log entries.

sigma tactics: impact techniques: T1485 sources: webserver, linux

Detection queries are available on the platform. Get full rules →