Description

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-27T06:17:27.057Z",
  "pubdate": "2026-08-27T06:17:27.057Z",
  "executiveSummary": "The Workeera WordPress plugin, specifically versions prior to 1.0.6, contains a critical security vulnerability involving improper input validation and access control.\nThe vulnerability is categorized as an Arbitrary File Deletion flaw, which allows low-privileged users, such as those with a 'subscriber' role, to delete arbitrary files on the underlying host server.\nThis vulnerability stems from a failure to validate user-supplied file paths during file removal operations and a lack of server-side restrictions on modifications to candidate profiles.\nSuccessful exploitation permits an authenticated attacker to delete sensitive configuration files, including wp-config.php, or other critical system files, potentially leading to a complete site compromise or denial-of-service (DoS) condition.\nNo specific elevated privileges are required, as the flaw is accessible to any registered subscriber account, significantly increasing the risk profile for WordPress environments utilizing this plugin.\nImmediate remediation is necessary to prevent unauthorized file system modification and maintain server integrity.",
  "technicalDetails": "The vulnerability resides within the Workeera plugin's profile management functionality. The plugin fails to adequately sanitize or validate user-supplied input intended for file path operations. Specifically, the component responsible for processing candidate profile updates and associated file deletions does not enforce path traversal protections or directory boundary checks.\nThe root cause is an insecure implementation of file deletion routines where the application trusts user-provided path data without canonicalization or validation against an expected, restricted directory scope.\nAn attacker with subscriber-level authentication can trigger this vulnerability by submitting a crafted request to the profile update endpoint. By manipulating the parameters associated with file removal, the attacker can force the application to execute a deletion function against an arbitrary path on the filesystem.\nStep-by-step exploitation flow: 1. The attacker authenticates as a subscriber. 2. The attacker intercepts the request used to update candidate profile information or remove associated documents. 3. The attacker injects a malicious file path (e.g., ../../../wp-config.php) into the parameter that the plugin uses to identify the file to be deleted. 4. The server-side code, lacking a whitelist or base-path verification, passes the attacker-supplied string to the file system API. 5. The server executes the deletion operation on the target file path, resulting in the removal of the sensitive file from the server.\nThis vulnerability is particularly severe because the plugin executes these operations with the privileges of the web server process. By targeting configuration files like wp-config.php, an attacker can effectively disable the WordPress installation, potentially forcing a site re-installation or exposing database credentials if the file content is leaked or the site enters an insecure state.\nThe vulnerability affects all versions of the Workeera plugin before 1.0.6. The lack of input validation at the subscriber level makes this a high-impact flaw for any multi-user WordPress instance, as it enables authenticated users to bypass standard security constraints and affect system-level stability.\nPost-exploitation impact includes persistent Denial of Service, potential data corruption, and the ability to destabilize the application environment to facilitate further attacks."
}