CVE-2026-77016
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it. Users with a role as low as subscriber can delete arbitrary files on the server.
Risk Assessment
An attacker can delete critical system files or data, potentially causing site downtime, data loss, or full server compromise.
Recommendation
Update the Workeera plugin to version 1.0.6 or later, which includes security fixes.
Original NVD description (English source)
The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server.