CVE-2025-69128: EMV JobCareer Path Traversal Vulnerability

CVE-2025-69128 Overview

CVE-2025-69128 is a path traversal vulnerability in the EMV JobCareer WordPress theme affecting all versions up to and including 7.3. The flaw maps to CWE-22, Improper Limitation of a Pathname to a Restricted Directory. Unauthenticated remote attackers can traverse outside the intended directory and delete arbitrary files on the host. Successful exploitation can corrupt the WordPress installation, remove configuration files such as wp-config.php, and force the site into a setup state that attackers can hijack. The vulnerability is network-exploitable, requires no privileges, and requires no user interaction.

Critical Impact
Unauthenticated attackers can delete arbitrary files on the underlying server, leading to full site compromise of WordPress instances running the JobCareer theme.

Affected Products

EMV JobCareer WordPress theme versions through 7.3
WordPress sites using JobCareer for job board functionality
Hosting environments where the theme has write access to files outside the theme directory

Discovery Timeline

2026-06-17 - CVE-2025-69128 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-69128

Vulnerability Analysis

The JobCareer theme exposes a file handling endpoint that accepts a user-controlled filename parameter without proper validation. The endpoint passes the parameter into a file deletion routine without canonicalizing the path or restricting it to a safe base directory. Attackers supply path traversal sequences such as ../../ to escape the theme's expected working directory and reach arbitrary locations on the file system.

The Patchstack advisory classifies the issue as an arbitrary file deletion vulnerability. Because the endpoint is reachable without authentication, any internet-facing site running JobCareer 7.3 or earlier is exposed. Deleting wp-config.php is a known technique that triggers WordPress to enter the installation wizard, allowing an attacker to point the site at a database under their control and gain administrative access.

Root Cause

The root cause is missing input validation on a filename parameter consumed by a file deletion function. The code does not enforce a whitelist of allowed paths, does not call realpath() to resolve the canonical location, and does not verify that the resolved path resides within an expected directory. Path traversal sequences pass through unchecked.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable theme endpoint with a traversal payload in the filename parameter. The request requires no session, cookie, or user interaction. The PHP process running WordPress executes the unlink operation under the web server's file system privileges. Files writable by the web server, including theme files, plugin files, uploaded media, and wp-config.php, are all candidates for deletion.

No public proof-of-concept is currently linked in the NVD record. Refer to the Patchstack advisory for vendor-confirmed technical details.

Detection Methods for CVE-2025-69128

Indicators of Compromise

HTTP requests to JobCareer theme endpoints containing ../ or URL-encoded %2e%2e%2f sequences in query or POST parameters
Unexpected deletion of wp-config.php, .htaccess, or core WordPress files on a site running JobCareer
WordPress unexpectedly displaying the installation setup page on a previously configured site
New admin_action or AJAX requests to theme handlers from unauthenticated sources

Detection Strategies

Inspect web server access logs for requests targeting JobCareer theme PHP files with traversal patterns in parameters
Deploy WordPress integrity monitoring to alert on deletion or modification of core, plugin, and configuration files
Correlate file deletion events on the web server with concurrent HTTP requests to the theme directory

Monitoring Recommendations

Enable web application firewall rules that block traversal sequences in HTTP parameters reaching /wp-content/themes/jobcareer/
Monitor file system audit logs for unlink() operations on files outside the theme directory initiated by the PHP-FPM or web server user
Track sudden spikes in 404 or 500 responses from theme endpoints, which can indicate enumeration

How to Mitigate CVE-2025-69128

Immediate Actions Required

Identify all WordPress sites running the JobCareer theme and confirm the installed version
Disable or remove the JobCareer theme on any site running version 7.3 or earlier until a patched release is available
Restrict file system permissions so the web server user cannot delete files outside required directories
Enable a web application firewall with rules that block path traversal payloads against theme endpoints

Patch Information

At the time of publication, the NVD record does not list a fixed version. The vulnerability affects JobCareer through 7.3. Monitor the Patchstack advisory and the theme vendor's release notes for an updated version that addresses the path traversal flaw.

Workarounds

Place the vulnerable theme endpoint behind authentication using a server-level rule such as an Apache Require directive or Nginx auth_basic
Apply virtual patching through a WAF to drop requests containing .., %2e%2e, or null byte sequences in JobCareer parameters
Switch to an alternative job board theme until the vendor releases a patched build
Maintain offline backups of wp-config.php and the WordPress root directory to recover from file deletion attacks

bash

# Example Nginx rule to block traversal payloads targeting the JobCareer theme
location ~* /wp-content/themes/jobcareer/ {
    if ($args ~* "(\.\./|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
    if ($request_uri ~* "(\.\./|%2e%2e%2f)") {
        return 403;
    }
}