{"id":"CVE-2026-39752","published":"2026-10-06T09:17:46.790","lastModified":"2026-10-06T15:04:25.990","description":"Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions.","cvssScore":7.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/job-postings/vulnerability/wordpress-jobs-for-wordpress-plugin-2-8-2-arbitrary-file-deletion-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows authenticated contributors to delete arbitrary files on the WordPress server by manipulating job parameters, potentially leading to remote code execution or data loss. This affects WordPress versions up to 2.8.2.","exploitability":"Exploitation requires an authenticated contributor account with access to job management features, making it moderately difficult but possible for attackers who can compromise such accounts.","blast_radius":"If exploited, this vulnerability could allow attackers to delete critical application files, configuration files, or uploaded media, potentially leading to complete site compromise or service disruption.","remediation":"Upgrade to WordPress version 2.8.3 or later to remediate this arbitrary file deletion vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["file-deletion","wp","privilege-escalation","arbitrary-file"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:00:54.628Z"}}