CVE-2026-77016: Unknown Workeera

Critical severity, CVSS 9.6. EPSS: 0.4% chance of exploitation in the next 30 days.

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server.

Affected products

• Unknown Workeera: before 1.0.6 (fixed in 1.0.6)

Published 2026-08-27. Last modified 2026-08-28.