CyberRota Analysis
AI-GeneratedThe Workeera WordPress plugin prior to version 1.0.6 allows users with subscriber-level access to delete arbitrary files on the server due to insufficient validation of file paths in user profile management. This vulnerability could lead to unauthorized data loss or manipulation, posing a significant risk to the integrity of the web application. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential exploitation.
Original NVD Description
The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server.