Workeera Plugin Arbitrary File Upload and RCE

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code execution.

Casky was already ahead

This CVE exploits attack patterns that Casky's 447matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-77018 is an arbitrary file upload vulnerability in the Workeera WordPress plugin that allows low-privileged users (subscriber role and above) to bypass file type validation and upload malicious files to publicly accessible directories. The vulnerability stems from insufficient input validation on candidate profile submissions and the lack of file type verification before writing files to disk. This is critical because WordPress subscriber accounts are commonly available to legitimate users, and successful exploitation leads to remote code execution—giving attackers complete control over the affected website and potentially the underlying server. Organizations running the Workeera plugin before version 1.0.6 face immediate risk of compromise, data theft, and lateral movement into their broader infrastructure.

Casky's 447 matching skills leverage Claude AI's extended reasoning to correlate attack patterns across MITRE ATT&CK's Initial Access (TA0001), Resource Development (TA0043), and Execution (TA0002) techniques. Practitioners using Casky would observe detections for: unrestricted file upload attempts exploiting CWE-434 weaknesses; suspicious PHP or executable file writes to web-accessible paths; privilege escalation from subscriber to code execution; and post-exploitation reconnaissance patterns. The platform maps these behavioral chains to specific attack techniques, enabling security teams to distinguish between legitimate file operations and adversarial uploads, identify the precise plugin version in use, and correlate findings with known exploitation patterns—accelerating threat detection and response before attackers establish persistence.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

447 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-77018.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-77018

Casky has 447 skills that investigate the attack patterns behind CVE-2026-77018. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn