Workeera vulnerabilities
We track 3 vulnerabilities in Workeera products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 27, 2026.
Latest Workeera vulnerabilities
- 8.8 High severity
Workeera: Unrestricted Upload of File with Dangerous Type
The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload ar
- 7.7 High severity
Workeera: Exposure of Sensitive Information to an Unauthorized Actor
The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on
- 9.6 Critical severity
Workeera: External Control of File Name or Path
The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbi