CVE-2026-77017

HighCVSS 7.7

Published: 27/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it. Users with a role as low as subscriber can read arbitrary files on the server, including its configuration file and authentication secrets.

Risk Assessment

An attacker can access sensitive data such as passwords and keys, potentially leading to full site compromise and data breach.

Recommendation

Update the Workeera plugin to version 1.0.6 or later, which includes security fixes.

Other vulnerabilities in Workeera

CVE-2026-77016Critical
The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it. Users with a role as low as subscriber can delete arbitrary files on the server.

Original NVD description (English source)

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its configuration file and authentication secrets.