Critical severity · published Mar 12, 2025
CVE-2024-13446
Workreap <= 3.2.5 - Unauthenticated Privilege Escalation via Account Takeover
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
The Workreap plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.2.5. This is due to the plugin not properly validating a user's identity prior to (1) performing a social auto-login or (2) updating their profile details (e.g. password). This makes it possible for unauthenticated attackers to (1) login as an arbitrary user if their email address is known or (2) change an arbitrary user's password, including administrators, and leverage that to gain access to their account. NOTE: This vulnerability was partially fixed in version 3.2.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
Workreap · AmentoTech
through 3.2.5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-13446
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-13446
Product
https://themeforest.net/item/workreap-freelance-marketplace-wordpress-theme/23712454
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/78c1308b-0849-4235-b2d6-0b1750a5614f?source=cve
More from Workreap
9.8
CVE-2025-4973
Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account'
9.8
CVE-2021-24499
The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request…
8.8
CVE-2025-5012
Workreap <= 3.3.2 - Authenticated (Subscriber+) Arbitrary File Upload via 'workreap_temp_upload_to_media'
8.1
CVE-2021-24501
The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as…
8.1
CVE-2021-24500
Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that were not validated