CVE-2026-77018: Unknown Workeera

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code execution.

Affected products

• Unknown Workeera: before 1.0.6 (fixed in 1.0.6)

Published 2026-08-27. Last modified 2026-08-28.