Executive brief
Workeera is a WordPress plugin that manages job seeker profiles and candidate applications. A flaw in how the plugin handles file upload paths allows any user with a subscriber account to read sensitive files from the server, including the WordPress configuration file containing database passwords and authentication keys. An attacker needs only to log in as a subscriber and manipulate profile fields to specify arbitrary file paths for download.
Technical details
The plugin suffers from mass assignment and path traversal vulnerabilities in its candidate profile functionality. The vulnerable component is the user resume/profile submission handler (workeera_user_resume_details_submission_call AJAX action), which does not validate or restrict the file paths supplied in the candidate_cv_files metadata field. An authenticated subscriber can submit an absolute filesystem path (e.g., /etc/passwd or /var/www/html/wp-config.php) as a file location, and the plugin will store this without sanitization. When the file is later retrieved via the workeera_files_action=download endpoint, the plugin reads and serves the specified file regardless of its location, bounded only by filesystem permissions of the web server user. No path traversal sequences are needed; absolute paths are accepted verbatim. Authentication and a valid nonce are required, but nonces are trivially obtained via unauthenticated AJAX endpoints. Fixed in version 1.0.6.
Affected products
- Workeera Workeera before 1.0.6
Timeline
- 2026-08-25: disclosed
- 2026-08-27: published