← volver
CVE-2026-6271

Career Section <= 1.7 - Unauthenticated Arbitrary File Upload

CVSS 9.8 CRITICALEPSS 0.7%CWE-434
The Career Section plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7 via the CV upload handler. This is due to missing file type validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
shahinurislam · Career Section
PoCs públicas encontradas — 1
githubgithub.com/xxconi/CVE-2026-6271★ 0
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →
Referencias
https://plugins.trac.wordpress.org/changeset/3507785/career-sectionhttps://plugins.trac.wordpress.org/changeset/3507912/career-sectionhttps://plugins.trac.wordpress.org/changeset/3507917/career-sectionhttps://www.wordfence.com/threat-intel/vulnerabilities/id/005d1abc-761d-4f9a-bc21-aad63e8efd66?source=cve