Executive brief
The Workeera WordPress plugin allows users with minimal permissions (as low as subscriber) to delete arbitrary files from the server. An attacker can inject malicious file paths into their own candidate profile and then trigger a deletion operation, enabling removal of critical system files or application data. This could cause service disruption, data loss, or compromise the integrity of the website.
Technical details
The vulnerability is a combination of mass assignment and insufficient path validation. The plugin's candidate profile update endpoint (workeera_user_resume_details_submission_call) does not restrict which fields can be modified, allowing an authenticated subscriber to inject arbitrary file paths into the candidate_cv_files array. Subsequently, the file deletion endpoint (workeera_cv_delete) fails to validate or sanitize the stored file path before passing it to unlink(), permitting deletion of any file accessible to the web server process, including those outside the web root. An attacker only needs a valid user account (subscriber role minimum) and the plugin's user-dashboard page to be published. No additional traversal sequences are required since absolute paths are accepted verbatim.
Affected products
- Workeera Remote Tech Job Board before 1.0.6
Timeline
- 2026-08-25: disclosed
- 2026-08-27: advisory
- 2026-08-25: patched: Fixed in version 1.0.6