File Deletion Vulnerability in Workeera WordPress Plugin Affects Users
CVE-2026-77016
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-77016?
The Workeera WordPress plugin prior to version 1.0.6 allows users with minimal permissions, such as subscribers, to delete arbitrary files from the server. This vulnerability arises due to the lack of restrictions on the values that can be written to a user's candidate profile, coupled with inadequate validation of file paths before deletion. As a result, malicious users could exploit this weakness to manipulate or remove critical files, posing significant risks to website integrity and security.
Affected Version(s)
Workeera 0 < 1.0.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.