CVE-2025-4973

CWE-2883 documents3 sources
Severity
9.8CRITICAL
EPSS
1.1%
top 22.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Amentotech Workreap
Timeline
PublishedJun 12

Description

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an account with an email address. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they know user's email address. This is only exploitable fi the u…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDamentotech/workreap< 3.3.2
▶CVEListV5amentotech/workreap3.3.1

🔴Vulnerability Details

2
GHSA
GHSA-q5jm-5p84-m8rp: The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all version↗2025-06-12
▶
CVEList
Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account'↗2025-06-12
▶
CVE-2025-4973 (CRITICAL CVSS 9.8) | The Workreap plugin for WordPress | cvebase.io