Skip to content
Sign in
8.8 High

CVE-2026-77018 The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor…

Description

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code execution.

Affected products and versions

Product Affected versions Fixed in
Workeera 1.0 earliest → < 1.0.6 1.0.6

Other CVEs of Workeera

The 3 CVEs of Workeera →
CVE-2026-77017 The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine… 7.7 High CVE-2026-77016 The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate… 9.6 Critical
Track this CVE