CVE-2026-77018 | BDVDB-2026-365539 Detail

Description#

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code execution.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-27Record published in the CVE List.