← back
CVE-2025-4973

Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account'

CVSS 9.8 CRITICALEPSS 0.4%CWE-288
Vexday Risk Score
28Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 9.8EPSS 0.4%KEV nãoPoC Nuclei Metasploit Patch
Lifecycle
12 Jun 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an account with an email address. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they know user's email address. This is only exploitable fi the user's confirmation_key has not already been set by the plugin.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
AmentoTech · Workreap

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →