CVE-2026-77018: Workeera WordPress Plugin RCE Vulnerability

CVE-2026-77018 Overview

CVE-2026-77018 affects the Workeera WordPress plugin in all versions prior to 1.0.6. The plugin fails to restrict which profile values a candidate may submit and does not validate the type of file it writes to a publicly reachable directory. Authenticated users with a role as low as subscriber can upload arbitrary files and achieve remote code execution on the underlying host. The flaw combines missing input validation with insecure file handling in the candidate profile workflow.

Critical Impact
Subscriber-level accounts can upload PHP or other executable files to a web-accessible path and trigger remote code execution against the WordPress host.

Affected Products

Workeera WordPress plugin versions prior to 1.0.6
WordPress sites permitting subscriber (or higher) account registration with Workeera installed
Any hosting environment executing PHP from the plugin's public upload directory

Discovery Timeline

2026-08-27 - CVE-2026-77018 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-77018

Vulnerability Analysis

The Workeera plugin exposes a candidate profile update handler that accepts arbitrary field names and file attachments from any authenticated user. The plugin writes submitted files to a directory served by the web server without enforcing an allowlist of MIME types or file extensions. An attacker with a subscriber account can submit a PHP payload disguised as, or explicitly named as, an executable script. Because the destination directory is publicly reachable, the attacker requests the uploaded file directly and the web server executes it as PHP code.

The vulnerability chains two distinct classes of weakness: Improper Input Validation on profile fields and Unrestricted Upload of File with Dangerous Type. Together they collapse the trust boundary between low-privilege authenticated users and code execution on the server.

Root Cause

The plugin does not enforce a schema on submitted profile values, allowing attackers to influence which field is treated as a file upload. The file-writing routine trusts the client-supplied filename and content type and skips server-side validation of the resulting artifact. See the WPScan Vulnerability Report for further technical context.

Attack Vector

Exploitation requires only a subscriber account, a role commonly available through open WordPress registration. The attacker submits a crafted profile update request containing a PHP file. After the plugin writes the file to its public directory, the attacker issues an HTTP GET to the resulting URL and the payload executes with the privileges of the PHP worker process.

// No verified proof-of-concept code is published. See the WPScan advisory
// linked above for reproduction details from the reporting researcher.

Detection Methods for CVE-2026-77018

Indicators of Compromise

New PHP, .phtml, or .phar files present under the Workeera plugin's upload directory
Unexpected HTTP POST requests to the plugin's profile update endpoint originating from subscriber accounts
Web server access logs showing GET requests to attacker-created files in the plugin upload path
Outbound network connections from the PHP worker process to unfamiliar hosts following upload activity

Detection Strategies

Inspect the plugin upload directory for files with executable server-side extensions and compare against expected candidate document types.
Correlate subscriber-role authentication events with subsequent file writes under wp-content/uploads/.
Alert on WordPress accounts created shortly before profile update requests that carry file attachments.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress wp-content/uploads/ tree and flag creation of scripts.
Forward WordPress and web server logs to a centralized platform for correlation of registration, upload, and request events.
Monitor PHP-FPM or web server child processes for spawning shells or making outbound connections.

How to Mitigate CVE-2026-77018

Immediate Actions Required

Update the Workeera plugin to version 1.0.6 or later on every affected WordPress instance.
Audit existing files under the plugin's upload directory and remove any server-executable artifacts.
Review recently created WordPress user accounts and revoke suspicious subscriber registrations.
Rotate WordPress administrator credentials and secret keys if evidence of code execution is found.

Patch Information

The vendor addressed the issue in Workeera 1.0.6. Administrators should apply the update through the WordPress plugin manager or by replacing the plugin files with the fixed release. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the Workeera plugin until the patched version is deployed.
Restrict WordPress user registration or set the default role to a value that cannot access the vulnerable profile handler.
Configure the web server to deny execution of PHP inside wp-content/uploads/ and plugin upload directories.
Place the site behind a web application firewall rule that blocks uploads of files with executable extensions.

bash

# Example nginx snippet: deny PHP execution inside WordPress uploads
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}