Skip to content
Sign in
7.7 High

CVE-2026-77017 The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine…

Description

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its configuration file and authentication secrets.

Affected products and versions

Product Affected versions Fixed in
Workeera 1.0 earliest → < 1.0.6 1.0.6

Other CVEs of Workeera

The 3 CVEs of Workeera →
CVE-2026-77018 The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor… 8.8 High CVE-2026-77016 The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate… 9.6 Critical
Track this CVE