// For flags

CVE-2025-4973

Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account'

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an account with an email address. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they know user's email address. This is only exploitable fi the user's confirmation_key has not already been set by the plugin.

El complemento Workreap para WordPress, utilizado por el tema Workreap - Freelance Marketplace para WordPress, es vulnerable a la omisión de la autenticación en todas las versiones hasta la 3.3.1 incluida. Esto se debe a que el complemento no verifica correctamente la identidad del usuario antes de iniciar sesión al verificar una cuenta con una dirección de correo electrónico. Esto permite que atacantes no autenticados inicien sesión como usuarios registrados, incluidos administradores, si conocen la dirección de correo electrónico del usuario. Esto solo es explotable si el complemento no ha configurado previamente la clave de confirmación del usuario.

*Credits: Friderika Baranyai
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2025-05-20 CVE Reserved
  • 2025-06-11 CVE Published
  • 2025-06-12 CVE Updated
  • 2025-07-07 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-288: Authentication Bypass Using an Alternate Path or Channel
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
AmentoTech
Search vendor "AmentoTech"
 Workreap
Search vendor "AmentoTech" for product "Workreap"
 <= 3.3.1
Search vendor "AmentoTech" for product "Workreap" and version " <= 3.3.1"
en
Affected