Workeera CVE-2026-77016

Exploitation requires an authenticated account at subscriber level or higher (PR:L) that can reach the plugin's candidate-profile update functionality - practically trivial on sites that allow open or self-service registration, and a hard blocker on sites that restrict account creation. The specific enabling condition is the plugin's failure to restrict values written to the user's own candidate profile combined with no validation/containment of the stored file path before deletion, so the attacker must be able to control that profile file-path value. No user interaction is needed (UI:N) and the attack is over the network (AV:N). The main limiting factors are the authentication requirement and whether the target site permits low-privilege account registration; there is no non-default configuration or specific platform dependency beyond having Workeera < 1.0.6 installed.

The signals are mixed and should be read together rather than off the 9.6 headline alone. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) is credible: network-reachable, low-complexity, and requiring only the lowest authenticated role (subscriber), which on any site allowing open or self-service registration is effectively a low bar. Countervailing signals are meaningful: EPSS is 0.14% (4th percentile), the vulnerability is not in CISA KEV, no public PoC is referenced, and CISA's SSVC framework rates Exploitation 'none', Automatable 'no', and Technical Impact only 'partial'. The 'partial' technical-impact and 'no' automatable ratings sit in tension with a 9.6 base score - the high score is driven by the scope change and high integrity/availability impact of arbitrary file deletion, not by mass-exploitability. Net: this is a genuine priority for any Workeera site that permits subscriber-level registration (arbitrary file deletion can escalate to site takeover), but it is more likely to see targeted rather than commodity, wormable exploitation given the low EPSS and lack of automation. Treat it as urgent to patch where the plugin is installed, while recognizing the real-world footprint of the product is small.

An attacker registers or obtains a subscriber account on a Workeera-enabled WordPress site, then submits a candidate-profile update containing a crafted file-path value pointing at a sensitive file such as wp-config.php. The plugin deletes the referenced file with web-server privileges; removing wp-config.php can push the site back into the installer, opening a path to full compromise, while deleting other files causes denial of service. No public exploit code is referenced, so this would currently require an attacker to craft the request themselves.