CVE-2026-6271

Career Section <= 1.7 - Unauthenticated Arbitrary File Upload

CVSS 9.8 CRITICALEPSS 0.7%CWE-434

Vexday Risk Score

48Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.8EPSS 0.7%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

14 May 2026Published on NVD

26 May 2026Public PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

The Career Section plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7 via the CV upload handler. This is due to missing file type validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

shahinurislam · Career Section

public PoCs found — 1

githubgithub.com/xxconi/CVE-2026-6271★ 0

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://plugins.trac.wordpress.org/changeset/3507785/career-section https://plugins.trac.wordpress.org/changeset/3507912/career-section https://plugins.trac.wordpress.org/changeset/3507917/career-section https://www.wordfence.com/threat-intel/vulnerabilities/id/005d1abc-761d-4f9a-bc21-aad63e8efd66?source=cve