CVE-2026-77016
Received Received - Intake

Arbitrary File Deletion in Workeera WordPress Plugin

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: WPScan

Description
The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-77016
EUVD
EUVD-2026-66878

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
workeera remote_tech_job_board to 1.0.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Workeera WordPress plugin before version 1.0.6 allows users with subscriber-level access or higher to delete arbitrary files on the server. It occurs due to improper restrictions on candidate profile updates and a lack of validation for file paths before deletion.

Detection Guidance

Check if the Workeera Remote Tech Job Board plugin version is below 1.0.6. Use WordPress admin panel or run a command like 'wp plugin list' if using WP-CLI to verify the installed version.

Impact Analysis

An attacker could exploit this to delete critical files on the server, potentially causing data loss, disrupting services, or compromising the entire WordPress installation. Even low-privileged users like subscribers can perform destructive actions.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized file deletion, potentially resulting in data breaches or loss of protected health information. Organizations may face penalties for failing to protect sensitive data.

Mitigation Strategies

Update the Workeera Remote Tech Job Board plugin to version 1.0.6 or later immediately. Remove or restrict subscriber-level access to sensitive operations until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77016. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart