Skip to content
Sign in
9.6 Critical

CVE-2026-77016 The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate…

Description

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server.

Affected products and versions

Product Affected versions Fixed in
Workeera 1.0 earliest → < 1.0.6 1.0.6

Other CVEs of Workeera

The 3 CVEs of Workeera →
CVE-2026-77018 The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor… 8.8 High CVE-2026-77017 The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine… 7.7 High
Track this CVE