CVE-2026-6271

Critical

Published: 14/05/2026(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Career Section plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to and including 1.7 due to missing file type validation in the CV upload handler. This allows unauthenticated attackers to upload potentially executable files, enabling remote code execution.

Risk Assessment

Organizations may be exposed to remote code execution by unauthorized users, potentially leading to serious security breaches and data loss.

Recommendation

It is recommended to update the Career Section plugin to the latest version and implement additional security measures, such as file type validation.

Original NVD description (English source)

The Career Section plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7 via the CV upload handler. This is due to missing file type validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.