Executive brief
The Workeera WordPress plugin, used to manage job board listings and candidate profiles, fails to validate file uploads and restricts profile modifications. An attacker with a subscriber-level account (commonly available on public job boards) can upload arbitrary files with disguised extensions and rewrite them to executable locations, achieving remote code execution on the web server and potentially gaining full control of the WordPress installation.
Technical details
The vulnerability is a combination of insufficient file type validation and mass assignment in the candidate profile submission endpoint. Attackers upload files with dual-valid magic bytes (e.g., PDF header plus PHP code), bypassing extension and MIME-type checks. The unrestricted profile save endpoint then allows rewriting the stored file path and name, moving the payload to a publicly accessible location (wp-content/uploads/) where it is executed by the web server. Attack preconditions are minimal: a subscriber-level account (routinely available on job boards), one published job listing, and a webserver not honouring .htaccess (nginx or Apache with AllowOverride None). The vulnerability was fixed in version 1.0.6.
Affected products
- Workeera Workeera Remote Tech Job Board before 1.0.6
Timeline
- 2026-08-25: disclosed
- 2026-08-27: advisory
- 2026: patched: Fixed in version 1.0.6