CVE-2026-77016

CriticalCVSS 9.6

Published: 27/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it. Users with a role as low as subscriber can delete arbitrary files on the server.

Risk Assessment

An attacker can delete critical system files or data, potentially causing site downtime, data loss, or full server compromise.

Recommendation

Update the Workeera plugin to version 1.0.6 or later, which includes security fixes.

Other vulnerabilities in Workeera

CVE-2026-77017High
The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it. Users with a role as low as subscriber can read arbitrary files on the server, including its configuration file and authentication secrets.

Original NVD description (English source)

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS