CVE-2026-77018

The Workeera WordPress plugin, prior to version 1.0.6 , fails to restrict which profile values a candidate may submit and does not validate the type of the file subsequently written into a publicly reachable directory. This allows users with a subscriber role (one of the lowest in WordPress) to p...

EUVD-2026-66879

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

CVE-2026-77017

CVE-2026-77017 affects the Workeera WordPress plugin prior to version 1.0.6 . The plugin does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it. This allows users with a role as low as subscriber to read arbitr...

EUVD-2026-66880

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

CVE-2026-77016

The Workeera WordPress plugin before 1.0.6 contains an arbitrary file deletion vulnerability. The plugin fails to restrict which values may be written to a user's own candidate profile and does not validate or contain the stored file path before attempting deletion. This allows a user with the su...

EUVD-2026-66878

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server...