CVE-2026-77017: CWE-200 Information Exposure in Workeera

The Workeera WordPress plugin versions prior to 1.0.6 contain an information exposure vulnerability (CWE-200) that permits users with subscriber-level roles to read arbitrary files on the server. This is due to insufficient validation of profile value submissions and lack of directory confinement for stored files before serving. Exploiting this flaw can disclose sensitive server files, including configuration and authentication secrets. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. No official patch or remediation guidance is currently documented.

An attacker with subscriber-level access can read arbitrary files on the server, potentially exposing sensitive information such as configuration files and authentication secrets. This can lead to further compromise of the server or application environment. The vulnerability does not impact integrity or availability directly but has a high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber role permissions where possible and monitor for suspicious file access patterns. Avoid granting unnecessary file access rights to low-privilege users.