CVE-2026-6271criticalCWE-434

CVE-2026-6271: critical vulnerability in shahinurislam Career Section

Career Section <= 1.7 - Unauthenticated Arbitrary File Upload

Published

Follow this CVE+ Monitor Career Section

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.8epss 0.7%
from disclosure to weapon12 days
Published on NVDMay 14
1st PoC+12d
The Career Section plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7 via the CV upload handler. This is due to missing file type validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
shahinurislam · Career Section
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — shahinurislam Career Section

In the same product, most dangerous first.

CVE-2025-14868HIGHCareer Section <= 1.6 - Cross-Site Request Forgery to Arbitrary File DeletionEPSS 0.4%