Description

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-27T06:17:27.500Z",
  "pubdate": "2026-08-27T06:17:27.500Z",
  "executiveSummary": "The Workeera WordPress plugin prior to version 1.0.6 is susceptible to an Arbitrary File Upload vulnerability leading to Remote Code Execution (RCE).\nThe vulnerability originates from a failure to perform adequate input validation and restriction on profile values submitted by users.\nThis flaw allows low-privileged users, such as those with the 'subscriber' role, to bypass security controls and upload malicious files—including executable scripts—to a directory that is directly accessible via the web server.\nThe impact is critical, as successful exploitation enables an attacker to execute arbitrary PHP code on the underlying web server, potentially leading to a complete compromise of the WordPress installation, sensitive data exfiltration, or unauthorized lateral movement within the hosting environment.\nThe attack does not require high-level administrative privileges, as the entry point is exposed to basic authenticated users, significantly increasing the risk profile for installations using the plugin.",
  "technicalDetails": "The vulnerability resides within the profile management functionality of the Workeera plugin, where the application fails to implement server-side validation for file uploads submitted during user profile updates.\nThe root cause is an improper trust model applied to user-supplied input. Specifically, the application does not enforce strict type checking or mime-type validation on the files uploaded through the candidate profile interface. Furthermore, the application lacks an allow-list approach to file extensions, allowing files with dangerous extensions (e.g., .php, .phtml) to be saved to the filesystem.\nThe attack flow begins with an attacker authenticating to the WordPress site with an account possessing 'subscriber' privileges. The attacker navigates to the profile update functionality provided by the Workeera plugin. During the profile update request, the attacker intercepts the HTTP POST request to inject a malicious file into the upload parameters.\nBecause the application does not restrict the path where these files are stored, they are written to a publicly reachable directory within the web root. Once the file is successfully uploaded, the attacker can navigate directly to the file's URL (e.g., /wp-content/uploads/...) via a web browser. Accessing this URL triggers the web server's PHP interpreter to execute the malicious script embedded in the uploaded file.\nThe payload behavior typically involves the execution of system-level commands, allowing the attacker to initiate a reverse shell, modify site configurations, or access the WordPress database directly. By achieving code execution, the attacker effectively bypasses the application's authentication and authorization layer, operating with the privileges of the web server user.\nThe vulnerable component is the file-handling logic responsible for processing user-submitted profile data. Affected versions include all versions of the Workeera plugin prior to 1.0.6. This vulnerability is remotely exploitable over HTTP/HTTPS, and the primary requirement is basic authenticated access to the target application. Post-exploitation impact includes full system compromise, data theft, and persistent unauthorized access via webshells."
}