CVE CVE-2026-6271

CVE-2026-6271

WordPress

Severity: CRITICAL
CVSS: 9.8CVSS
Published: 2026-05-14
Last modified: 2026-05-14
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-434

Description

The Career Section plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7 via the CV upload handler. This is due to missing file type validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

References

https://plugins.trac.wordpress.org/changeset/3507785/career-section
https://plugins.trac.wordpress.org/changeset/3507912/career-section
https://plugins.trac.wordpress.org/changeset/3507917/career-section
https://www.wordfence.com/threat-intel/vulnerabilities/id/005d1abc-761d-4f9a-bc21-aad63e8efd66?source=cve

Summary

Description

References