CVE-2026-6271

9.8 Critique

Publiée le 14/05/2026 à 09:16 · Modifiée le 17/06/2026 à 13:00 · Analyse NVD reportée · Source : security@wordfence.com

Description

The Career Section plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7 via the CV upload handler. This is due to missing file type validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

Traduire en français

Produits concernés

shahinurislam Career Section

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	security@wordfence.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-434

Références

https://plugins.trac.wordpress.org/changeset/3507785/career-section
https://plugins.trac.wordpress.org/changeset/3507912/career-section
https://plugins.trac.wordpress.org/changeset/3507917/career-section
https://www.wordfence.com/threat-intel/vulnerabilities/id/005d1abc-761d-4f9a-bc21-aad63e8efd66?source=cve

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories