Description

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its configuration file and authentication secrets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-27T06:17:27.307Z",
  "pubdate": "2026-08-27T06:17:27.307Z",
  "executiveSummary": "The Workeera WordPress plugin prior to version 1.0.6 is susceptible to an Arbitrary File Read vulnerability.\nThis flaw arises from insufficient input validation and a lack of proper directory confinement within the plugin's profile management functionality.\nThe vulnerability allows authenticated users with minimal privileges, specifically the subscriber role, to bypass security controls and read arbitrary sensitive files from the underlying server filesystem.\nThe impact of this vulnerability is severe, as it grants attackers the ability to exfiltrate critical server data, including application configuration files and sensitive authentication secrets, such as database credentials or security salts.\nThis exposure can lead to full server compromise, unauthorized access to the database, or escalation of privileges. No complex exploit chains are required, as the vulnerability is accessible directly through the application's profile submission mechanisms.\nGiven the severity and the low barrier for exploitation, immediate remediation is required to prevent unauthorized data access and potential server takeover.",
  "technicalDetails": "The vulnerability originates from the Workeera plugin's failure to enforce strict input sanitization and validation on profile data submission endpoints. Specifically, the plugin does not properly restrict the values a candidate can provide during the profile update process.\nFurthermore, the backend component responsible for processing these submitted profile values fails to validate or sanitize file paths. When the plugin later serves or accesses these files, it does not confine the operation to an authorized or sandboxed directory.\nThis lack of path validation allows an attacker to perform a Directory Traversal attack. By supplying specially crafted, path-traversal payloads—typically utilizing sequences such as '../'—within the input parameters that are subsequently treated as file paths, an attacker can escape the intended directory scope.\nBecause the plugin executes these operations within the context of the WordPress application process, it inherits the permissions assigned to the web server user. This permits the plugin to access any file readable by that system user.\nThe attack flow proceeds as follows: First, an attacker authenticates as a user with the subscriber role. Second, the attacker interacts with the profile management interface provided by the Workeera plugin. Third, the attacker injects malicious path-traversal strings into profile fields that the plugin improperly processes as file paths.\nFinally, the plugin attempts to access or serve the file specified by the manipulated input. If successful, the server returns the contents of the target file back to the user, effectively bypassing file access controls.\nThe primary risk post-exploitation includes the retrieval of sensitive files such as 'wp-config.php'. Access to this file exposes the WordPress authentication keys, salt values, and database connection strings. Possession of these credentials enables the attacker to directly connect to the database, modify user accounts (potentially granting themselves administrative privileges), or gain persistent backdoor access to the environment.\nAffected versions include all iterations of the Workeera plugin prior to 1.0.6. The requirement for a subscriber-level account is minimal, as registration is often open on many WordPress instances, significantly increasing the attack surface.\nThe vulnerability persists due to the absence of robust input validation logic and the failure to implement path normalization and allow-listing when handling file system paths."
}