← voltar
CVE-2026-6271

Career Section <= 1.7 - Unauthenticated Arbitrary File Upload

CVSS 9.8 CRITICALEPSS 0.7%CWE-434
The Career Section plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7 via the CV upload handler. This is due to missing file type validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
shahinurislam · Career Section
PoCs públicas encontradas — 1
githubgithub.com/xxconi/CVE-2026-6271★ 0
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →
Referências
https://plugins.trac.wordpress.org/changeset/3507785/career-sectionhttps://plugins.trac.wordpress.org/changeset/3507912/career-sectionhttps://plugins.trac.wordpress.org/changeset/3507917/career-sectionhttps://www.wordfence.com/threat-intel/vulnerabilities/id/005d1abc-761d-4f9a-bc21-aad63e8efd66?source=cve