CVE-2026-77016 Overview
CVE-2026-77016 affects the Workeera WordPress plugin in versions before 1.0.6. The plugin fails to restrict which values a user can write to their own candidate profile. It also does not validate or contain the stored file path before deleting it. Authenticated users with a role as low as subscriber can leverage this flaw to delete arbitrary files on the server. Deleting critical files such as wp-config.php can trigger WordPress reinstallation flows, which attackers commonly chain into full site takeover.
Critical Impact
A subscriber-level account can delete arbitrary files on the web server, enabling site compromise and takeover through WordPress reinstallation abuse.
Affected Products
- Workeera WordPress plugin versions prior to 1.0.6
- WordPress sites with authenticated subscriber (or higher) registration enabled
- Any hosting environment where the plugin has write access to files outside the intended profile scope
Discovery Timeline
- 2026-08-27 - CVE-2026-77016 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-77016
Vulnerability Analysis
The Workeera plugin exposes a candidate profile update flow that trusts user-supplied input for fields governing stored file paths. Because the plugin does not restrict which profile values a user can write, an authenticated user can inject or overwrite the file path attribute associated with their profile. When the plugin later performs a delete operation on that stored path, no validation or containment logic ensures the path resides within an expected uploads directory. The result is an arbitrary file deletion primitive available to any authenticated user, including the lowest-privileged subscriber role.
Root Cause
Two compounding defects create the vulnerability. First, the plugin performs insufficient authorization on profile field writes, allowing users to set fields they should not control [CWE-284]. Second, the file deletion routine trusts the stored path without canonicalization or a base-directory check, producing a path traversal condition [CWE-22] that resolves outside the intended directory.
Attack Vector
An attacker registers or uses an existing subscriber account. They submit a crafted profile update that assigns a controlled value, such as ../../../../wp-config.php, to the internal file-path attribute. When the plugin executes its file cleanup or delete flow tied to that profile field, it deletes the target file on disk. Deleting wp-config.php places WordPress into the setup state, which an unauthenticated attacker can then complete to gain administrative control. See the WPScan Vulnerability Advisory for technical details.
Detection Methods for CVE-2026-77016
Indicators of Compromise
- Missing or truncated wp-config.php, .htaccess, or plugin files without a corresponding administrative action in the audit log
- Unexpected transitions of the site to the WordPress installation wizard (/wp-admin/install.php)
- Requests to Workeera profile update endpoints from subscriber accounts containing path traversal sequences such as ../
Detection Strategies
- Inspect webserver access logs for POST requests to Workeera profile endpoints that include suspicious path characters in request bodies
- Monitor file integrity on WordPress core files, particularly wp-config.php, and alert on unexpected deletions
- Correlate low-privileged user activity with subsequent file deletion events on the underlying host
Monitoring Recommendations
- Enable WordPress audit logging for profile updates and file operations initiated by non-administrative accounts
- Track subscriber account creation rates and flag registrations followed quickly by profile update requests
- Alert when the WordPress installer endpoint becomes reachable on a previously provisioned site
How to Mitigate CVE-2026-77016
Immediate Actions Required
- Update the Workeera plugin to version 1.0.6 or later on all affected WordPress sites
- Audit subscriber and higher role accounts for suspicious registrations or recent profile modifications
- Verify integrity of wp-config.php and other WordPress core and plugin files, restoring from backup if any are missing
Patch Information
The vendor addressed the issue in Workeera version 1.0.6. Site administrators should upgrade to the fixed release through the WordPress plugin dashboard or by replacing the plugin directory from the official source. Refer to the WPScan Vulnerability Advisory for advisory details.
Workarounds
- Disable the Workeera plugin until the update to 1.0.6 or later can be applied
- Disable open user registration (Settings > General > Anyone can register) to eliminate the subscriber attack surface
- Apply filesystem permissions that prevent the webserver user from deleting files outside the wp-content/uploads directory
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
