CVE-2026-77018: Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment
The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Workeera WordPress pluginto a version that resolves this vulnerability.Fixed in 1.0.6
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with at least the Subscriber role can exploit the issue. An attacker therefore needs an account on the affected site, but does not need elevated WordPress privileges.
Are sites running the default WordPress Subscriber role configuration exposed?
Yes, if the affected Workeera plugin is installed and users can hold the standard Subscriber role, those users meet the minimum privilege level described for exploitation.
What is the likely impact of successful exploitation?
An attacker can upload arbitrary files to a publicly reachable directory and achieve remote code execution. This can allow execution of attacker-controlled code on the WordPress site.
How can I determine whether my site is affected?
Check whether the Workeera Remote Tech Job Board plugin version is earlier than 1.0.6. Also review whether Subscriber or other low-privileged accounts exist, as those accounts may be able to submit candidate profile values.