Veille CVE

Recherche « Unknown Workeera »

3 CVE

Critique 1 Élevée 2 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Workeera » ✕
  1. CVE-2026-77018 8.8 Élevée

    Unknown Workeera

    The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code execution.

  2. CVE-2026-77017 7.7 Élevée

    Unknown Workeera

    The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its configuration file and authentication secrets.

  3. CVE-2026-77016 9.6 Critique

    Unknown Workeera

    The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server.