The Workeera WordPress plugin before version 1.0.6 fails to limit the profile fields that candidates can submit and does not constrain the file path used when serving uploaded files. This flaw allows a user with a subscriber role to request arbitrary files from the server, including sensitive configuration and authentication credentials. The impact is a confidentiality breach through reading any file accessible to the web process, potentially exposing private data and credentials.

The vulnerability affects the Workeera plugin for WordPress on any site running a version older than 1.0.6. Even users with only subscriber privileges can trigger the sub‑mission, and the flaw is present regardless of other role capabilities. The only mitigation is to stop using the affected plugin or to upgrade to a patched version.

EPSS score is <1%, and the flaw is not listed in the CISA KEV catalog. Because the flaw is exploitable by users with the lowest non-admin role, an attacker does not need elevated privileges or advanced technical skills to read files. The CVSS score of 7.7 indicates a high severity, and the ability to access all server files gives the vulnerability a significant business impact. An attacker can use this flaw to exfiltrate sensitive data directly via HTTP requests to the plugin’s file viewer endpoint.