Executive brief
The Career Section plugin for WordPress, which allows businesses to manage job listings and applicant resumes, contains a critical security flaw in its resume upload feature. An attacker can exploit this to upload malicious files, such as web shells, directly to the server without needing a password. This could lead to a complete takeover of the website, allowing unauthorized access to sensitive data or the disruption of business operations.
Technical details
The Career Section plugin for WordPress (versions <= 1.7) is vulnerable to an unrestricted arbitrary file upload (CWE-434) within its CV upload handler. The vulnerability stems from a lack of file type validation, allowing unauthenticated remote attackers to upload malicious files, such as PHP scripts, to the server. By accessing the uploaded file, an attacker can achieve remote code execution (RCE), leading to full system compromise. The issue has been addressed in subsequent updates via changesets in the plugin's repository.
Affected products
- WordPress Plugin Career Section up to, and including, 1.7
Timeline
- 2026-05-14: disclosed
- 2026-05-14: advisory
References
- https://plugins.trac.wordpress.org/changeset/3507785/career-section
- https://plugins.trac.wordpress.org/changeset/3507912/career-section
- https://plugins.trac.wordpress.org/changeset/3507917/career-section
- https://www.wordfence.com/threat-intel/vulnerabilities/id/005d1abc-761d-4f9a-bc21-aad63e8efd66?source=cve