The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server.

The Workeera WordPress plugin before version 1.0.6 contains a critical vulnerability allowing low-privileged users (subscriber role or higher) to delete arbitrary files on the server. The plugin fails to restrict which values can be written to a user's candidate profile and does not validate or sanitize the stored file path before deletion. This lack of input validation and access control enables attackers to exploit the file deletion functionality maliciously. The vulnerability could lead to significant damage including deletion of critical system files, configuration files, or other sensitive data. Users are advised to update to version 1.0.6 or later to remediate the issue.