CVE-2026-6271 is an arbitrary file upload vulnerability in the Career Section WordPress plugin by shahinurislam. The issue arises because the plugin fails to validate the types of files uploaded through its CV upload handler, allowing attackers without authentication to upload potentially executable files. This can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability affects all versions up to 1.7. No vendor advisory or patch information is currently available, and no known exploits have been reported.

An unauthenticated attacker can upload files of dangerous types due to lack of file type validation, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The CVSS score of 9.8 reflects the critical nature and ease of exploitation over the network without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitoring for suspicious file uploads and restricting file upload permissions may reduce risk but do not fully mitigate the vulnerability.