Security Alert Summary
The Workeera WordPress plugin (versions before 1.0.6) contains a vulnerability that allows authenticated users with low-level roles, such as subscriber, to delete arbitrary files on the server. The issue is caused by insufficient validation of values written to a user’s candidate profile and a lack of checks on stored file paths before deletion.
CVE Details
- CVE ID:
CVE-2026-77016 - Affected component: Workeera WordPress plugin
- Affected versions: Versions before 1.0.6 (versions < 1.0.6)
- Published: August 27, 2026 at 6:17:27 AM
- Last modified: August 27, 2026 at 6:17:27 AM
- CVSS v3.1 base score / severity / vector: Not provided in the CVE data
- Authentication requirements: Authentication required (issue affects authenticated users)
- Privileges required: Low (users with the subscriber role can trigger the issue)
- User interaction: Not required beyond authenticated access with a low-privilege account
- Primary impact: Integrity and availability (arbitrary file deletion). Confidentiality impact is possible if sensitive files are removed.
- CWE / weakness ID: Not specified in the CVE data
Technical Details
The plugin does not restrict which values may be written to a user’s own candidate profile and fails to validate or contain the stored file path before performing a delete operation. Because the delete operation uses an unchecked stored path, an authenticated user with a subscriber role can cause the plugin to delete files outside of an expected, restricted location.
The CVE description does not name specific functions, hooks, or REST API endpoints. Based on the provided information, the root cause is insufficient input validation and lack of path containment checks for file deletion. The direct impact is removal of files on the server, which can lead to loss of site assets, plugins, or other files that affect site operation.
How This Could Impact Your Website
Consider a site with multiple users: a site owner, internal staff who manage content, and external contributors or contractors with subscriber-level accounts. If an attacker or a compromised low-privilege account alters allowed profile values or leverages the unchecked delete behavior, files used by the site could be removed. Practical consequences include broken pages due to missing assets, loss of plugin data, or removal of files needed for site functionality.
There is also an increased risk of targeted social engineering: exposed or altered user information may make staff or contractors easier to impersonate, and missing files could interrupt business operations while you investigate and restore data. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially subscriber and contributor accounts that can upload or edit profile data.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and restrict file system permissions where possible.
- Monitor site activity and logs for unusual file delete operations or profile changes.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
