CVE-2026-77018

Name of the Vulnerable Software and Affected Versions Workeera WordPress plugin versions prior to 1.0.6

Description Users with a role as low as subscriber can upload arbitrary files to a publicly reachable directory. This occurs because the plugin does not restrict the profile values a candidate can submit nor validate the file type being written. This flaw can lead to remote code execution, a situation where an attacker can execute arbitrary commands on the server.

Recommendations Update the Workeera WordPress plugin to version 1.0.6 or later.