Security Alert Summary
The Workeera WordPress plugin (versions before 1.0.6) allows users with a role as low as subscriber to read arbitrary files on the server. The plugin fails to restrict which profile values a candidate may submit and does not confine the stored file location to an allowed directory before serving it, which can expose configuration files and authentication secrets.
CVE Details
- CVE ID:
CVE-2026-77017 - Affected component: Workeera WordPress plugin
- Affected versions: Versions before 1.0.6 (less than 1.0.6)
- Published: August 27, 2026 at 06:17:27 AM UTC
- Last modified: August 27, 2026 at 06:17:27 AM UTC
- CVSS v3.1: Not provided in the available data
- Authentication required: Yes – an authenticated account is required; users with the subscriber role are sufficient
- Privileges required: Subscriber (low-level user account)
- User interaction: The vulnerability is triggered by submitting profile values and requesting served files
- Primary impact: Confidentiality (exposure of sensitive files and secrets). Integrity and availability impacts are not indicated in the provided data.
- CWE / weakness ID: Not specified in the available data
Technical Details
The plugin does not restrict which profile values a candidate may submit and it fails to confine the stored file location to an allowed directory before serving files. Because of these missing checks, an authenticated user with a subscriber role can request arbitrary files on the server and receive their contents. The description specifically notes that this can include the site configuration file and authentication secrets.
No specific functions, hooks, or REST API endpoints are named in the provided information. The core issue is the absence of input validation and path restriction when storing and serving uploaded or referenced profile-related files.
Impact is limited to information disclosure of files that the web server can read. The vulnerability does not, based on the provided data, describe remote code execution, privilege escalation, or direct modification of server files.
How This Could Impact Your Website
Consider a small company site that uses Workeera where the site owner, an internal HR staff member, and external contractors each have WordPress accounts. If a contractor or a regular subscriber account is able to submit specially crafted profile values that lead the plugin to serve arbitrary files, the following realistic consequences could occur:
- Exposure of internal configuration files that contain database credentials or API keys.
- Disclosure of internal user email addresses and other private information stored in configuration or backup files.
- Increased risk of targeted phishing or social engineering against staff members if contact details or secrets are exposed.
If you are unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and subscriber accounts that do not need file upload or profile modification capabilities.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and access logs for unusual file access patterns or unexpected requests to file-serving endpoints.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
