Threats tagged 'ghsa-gmqc-8f92-w42j'

CVE-2026-77017 is a high-severity information exposure vulnerability in the Workeera WordPress plugin before version 1.0.6. It allows users with minimal privileges (subscriber role) to read arbitrary files on the server, including sensitive files such as configuration files and authentication secrets. This occurs because the plugin does not restrict which profile values a candidate may submit nor confines stored file locations to allowed directories before serving them.