Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-4973

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an account with an email address. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they know user's email address. This is only exploitable fi the user's confirmation_key has not already been set by the plugin.

Published

2025-06-12T06:15:23.440

Last Modified

2025-07-10T00:13:10.950

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

Weaknesses
  • Type: Secondary
    CWE-288
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application amentotech workreap < 3.3.2 Yes
References