Aller au contenu
Se connecter
8.8 Élevée

CVE-2026-77018 The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor…

Description

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code execution.

Produits et versions touchés

Produit Versions touchées Corrigé en
Workeera 1.0 premières → < 1.0.6 1.0.6

Autres CVE de Workeera

Les 3 CVE de Workeera →
CVE-2026-77017 The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine… 7.7 Élevée CVE-2026-77016 The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate… 9.6 Critique
Suivre cette CVE