CVE-2026-6271

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Career Section plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7 via the CV upload handler. This is due to missing file type validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
shahinurislamCareer Section<= 1.7

References

Timeline

Published
May 14, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-627107.8Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally.CVE-2026-627117.8Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.CVE-2026-627127.8Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.CVE-2026-627137.8Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.CVE-2026-627146.5Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent netwoCVE-2026-627156.5Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent netwoCVE-2026-627166.5Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent netwoCVE-2026-627177.8Heap-based buffer overflow in Windows Message Queuing allows an authorized attacker to elevate privileges locally.CVE-2026-627186.5Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent netwoCVE-2026-627197.8Heap-based buffer overflow in Windows Message Queuing allows an authorized attacker to elevate privileges locally.CVE-2026-62728.5A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 OpenProviderStreamCVE-2026-627206.5Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent netwo
CVE-2026-6271: Critical severity, CVSS 9.8 | Vulnix