Unrestricted File Deletion via WordPress Plugin Profile Update

The Workeera WordPress plugin before version 1.0.6 contains a critical arbitrary file deletion vulnerability stemming from insufficient input validation and path traversal protection. By exploiting the candidate profile update functionality, attackers with subscriber-level privileges—the lowest authenticated role in WordPress—can manipulate file path parameters to delete any file accessible to the web server process. This vulnerability is particularly dangerous because it requires minimal access requirements and can lead to complete site compromise through deletion of critical WordPress configuration files, database backups, or security plugins. Any WordPress installation using this plugin before 1.0.6 is exposed, affecting potentially thousands of websites that rely on the Workeera recruitment functionality.

While this CVE does not map to specific MITRE ATT&CK techniques in public databases, Casky's extended reasoning capabilities would detect the attack patterns associated with Defense Evasion (T1070 - Indicator Removal) and Impact (T1531 - Account Access Removal, T1485 - Data Destruction) tactics. Practitioners using Casky would observe findings flagging suspicious profile update requests containing path traversal sequences (../, encoded variants), unexpected file deletion operations post-authentication, and logs showing subscriber accounts performing file system operations beyond normal profile scope. The platform's 754 mapped security skills would enable detection of anomalous behavior patterns: low-privileged users triggering deletion operations, unvalidated input reaching file system operations, and POST requests to profile endpoints containing file path parameters—all signature indicators of this exploitation chain.