PT-2026-40890 · WordPress · Career Section

Paolo Tresso · Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-6271

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Career Section versions prior to 1.8

Description The Career Section plugin for WordPress allows unauthenticated attackers to perform arbitrary file uploads through the CV upload handler. This issue stems from a lack of file type validation, enabling the upload of executable files that can lead to remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-6271

Affected Products

Career Section

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-6271 · Security Note
• https://t.me/CVEtracker/53761 · Telegram Post
• https://twitter.com/KaitanSecurity/status/2054826553314279501 · Twitter Post
• https://twitter.com/TechTranslators/status/2055032887976624581 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3507917/career-section · Note
• https://plugins.trac.wordpress.org/changeset/3507785/career-section · Note
• https://twitter.com/VulmonFeeds/status/2054893582956265585 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3507912/career-section · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/005d1abc-761d-4f9a-bc21-aad63e8efd66?source=cve · Note
• https://twitter.com/OrizonCyber/status/2054849257727803537 · Twitter Post
• https://t.me/cveNotify/163413 · Telegram Post