CVE-2025-47438 is a high severity file inclusion flaw (CVSS 8.1) in WP Job Portal, a WordPress plugin. Versions up to and including 2.3.1 can be made to include local files from the server. Update the plugin to version 2.3.2 or later, and check your logs for odd requests.
What's affected
The record lists WP Job Portal, plugin slug wp-job-portal, from the earliest version through 2.3.1. The Patchstack entry shows 2.3.2 as the patched version. Patchstack also lists the required privilege as unauthenticated, which means a visitor without an account.
If you run version 2.3.2 or later, this CVE does not apply to you.
How to check if you're exposed
On a site you manage, WP-CLI gives the installed version in one line.
wp plugin get wp-job-portal --field=version
Without WP-CLI, open Plugins in the WordPress admin and read the version under WP Job Portal. If the plugin is installed but deactivated, remove it or update it anyway, because deactivated plugin files stay on disk.
Agencies and hosts with many sites should list the plugin across all of them.
wp plugin list --name=wp-job-portal --fields=name,version,status
Run that per site, or through your management tool. Anything at 2.3.1 or lower needs action.
What to do now
- Update WP Job Portal to 2.3.2 or later on every site.
- If you cannot update today, deactivate and delete the plugin until you can.
- Check your web server logs for unusual requests to the plugin paths, and look for requests that pass file paths as parameters.
- Keep file permissions tight and keep secrets such as database credentials out of reach of the web user where you can.
- Turn on automatic updates for plugins that are exposed to the public.
Patchstack's own advice is the same: update the plugin, and ask your host or developer for help if you cannot.
Why it matters
The record maps this to CWE-98, improper control of the filename for an include or require statement in a PHP program. In plain terms, the plugin builds a filename from input it should not trust and then loads that file as code. The record calls it PHP local file inclusion.
Local file inclusion can expose files that were never meant to be served. Depending on the server it can go further, which is why Patchstack describes such flaws as sometimes leading to takeover. The score of 8.1 reflects a network attack with no privileges and no user interaction, with high impact on confidentiality and integrity. The complexity is rated high, which keeps it from scoring higher.
This CVE is not on the CISA Known Exploited Vulnerabilities list. Patchstack describes this class of flaw as the kind used in mass campaigns, but that is a general statement and does not say this one has been exploited.
Plugins that load files by name need a fixed list of allowed files, not a path assembled from a request. That is the habit to look for in other plugins you rely on.
Quick check
Do attackers need a login?
Patchstack lists the required privilege as unauthenticated, and the CVSS vector sets privileges required to none.
Which version fixes it?
Patchstack shows 2.3.2 as the patched version. Update to that or anything newer.
You can check dependency manifests for known issues with the free in-browser scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 18 October 2026.
