CVE-2026-6271: Career Section WordPress Plugin Unrestricted File Upload
The Career Section WordPress plugin contains an arbitrary file upload flaw in its CV upload handler, caused by missing file type validation, in all versions up to and including 1.7. The CVSS 3.1 score from Wordfence is 9.8 (critical), and the description notes that unauthenticated attackers could upload potentially executable files, which may enable remote code execution. The record does not list a fixed version, and no KEV listing appears.
Overview
The Career Section plugin for WordPress has an arbitrary file upload weakness in its CV upload handler, tracked as CVE-2026-6271. According to the record, the handler lacks file type validation in all versions up to and including 1.7.
Impact
The CVSS 3.1 score provided by Wordfence is 9.8 (critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This vector indicates network reachability, no privileges or user interaction required, and high impact on confidentiality, integrity and availability. The description states that unauthenticated attackers may upload files that could be executable, which makes remote code execution possible.
Affected products and versions
- Product: Career Section plugin for WordPress (career-section).
- Affected versions: all versions up to and including 1.7, as stated in the description.
- Fixed version: not stated in the available record.
The record lists three WordPress plugin repository changesets as references. Their content was not available for this analysis, so their relationship to a fix is unknown.
Exploitation status
This CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.01079 with a percentile of 0.6418, which is a statistical estimate and not evidence of exploitation.
Remediation and mitigation
- Identify any installation of the Career Section plugin and confirm its version.
- Check the vendor and the WordPress plugin repository for a release newer than 1.7, and apply it when it is confirmed.
- If no fixed version can be verified, consider disabling or removing the plugin until a verified fix is available.
- Restrict access to the CV upload function where operationally feasible, and configure the web server so that files in upload directories cannot be executed.
Detection guidance
- Review web server logs for unexpected requests to the plugin's upload functionality, especially from unauthenticated sources.
- Monitor upload directories for files with unexpected extensions or executable content.
- Look for unexpected child processes started by the web server user.
Limitations of the available information
The record contains no affected or fixed version data, no KEV entry, and no vendor advisory text beyond the description. No English title was provided, so the title was derived from the plugin name and weakness class. The EPSS date in the record is later than the publication date and should be verified against a current source. This analysis does not describe how to reach the upload endpoint.
Frequently asked questions
What is CVE-2026-6271?
It is an arbitrary file upload vulnerability in the CV upload handler of the Career Section WordPress plugin, caused by missing file type validation, affecting versions up to and including 1.7.
Can unauthenticated users exploit it?
The description states that unauthenticated attackers can upload files, and the CVSS vector shows no privileges or user interaction required. The record does not describe any confirmed exploitation.
Is a fixed version available?
The record does not state a fixed version. Check the vendor and the WordPress plugin repository for a release newer than 1.7 and treat the fix as unconfirmed until verified.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.