CVE-2026-77017: Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Profile Mass Assignment
The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its configuration file and authentication secrets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Workeera WordPress pluginto a version that resolves this vulnerability.Fixed in 1.0.6
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with at least the Subscriber role can exploit it. Sites that allow untrusted users to register or retain Subscriber accounts are therefore exposed.
What access does an attacker need?
The attacker needs an authenticated WordPress account with Subscriber-level access or higher. The provided information does not indicate that unauthenticated visitors can exploit the issue.
Are default installations affected?
Affected installations are those running a Workeera plugin version earlier than 1.0.6. Exploitation also depends on an attacker being able to use a candidate profile.
What could an attacker access?
An attacker can read arbitrary files from the server, potentially including the WordPress configuration file and authentication secrets. Exposure of these files may enable compromise of database credentials or other sensitive application secrets.
What can be done while patching is delayed?
Restrict or remove untrusted Subscriber accounts and prevent untrusted users from accessing candidate-profile functionality. Review server and WordPress configuration files and rotate exposed authentication secrets if exploitation is suspected.