PT-2026-82420 · WordPress · Workeera
CVE-2026-77017
·
Published
2026-08-27
·
Updated
2026-08-27
CVSS v3.1
7.7
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Workeera WordPress plugin versions prior to 1.0.6
Description
Users with a role as low as subscriber can read arbitrary files on the server, including configuration files and authentication secrets. This occurs because the plugin does not restrict the profile values a candidate can submit and fails to confine the stored file location to an allowed directory before serving it.
Recommendations
Update Workeera WordPress plugin to version 1.0.6 or later.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Workeera