A critical vulnerability in the Workeera WordPress plugin allows authenticated users to perform unauthorized file deletions, potentially leading to a complete compromise of system availability.

The plugin fails to validate file paths when processing deletions within a user candidate profile, permitting a low-privileged subscriber to delete arbitrary files from the server filesystem.

Successful exploitation of this vulnerability allows an attacker to delete critical system files or website configuration files, which can result in significant service downtime and loss of data integrity. Given the CVSS score of 9.6, this flaw presents a severe risk to business operations, as it enables an authenticated user to perform destructive actions that can render the entire WordPress instance non-functional.

Immediate Action: Update the Workeera WordPress plugin to version 1.0.6 or later immediately to incorporate necessary input validation.

Proactive Monitoring: Review server access logs for anomalous file deletion patterns or unauthorized attempts to access sensitive system paths by subscriber-level accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing directory traversal sequences or suspicious path parameters directed at the plugin interface.

Public Exploit Available: No

The vulnerability represents a critical risk to any WordPress environment utilizing the Workeera plugin. Administrators should prioritize patching to version 1.0.6 immediately, as the low barrier to entry for attackers makes this an attractive target for service disruption. If an update cannot be applied immediately, consider disabling the plugin until a secure version is deployed.