CVE-2021-24499

🗓️ 09 Aug 2021 00:00:00Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 267 Views🌐 WEB

Workreap WordPress theme before 2.2.2 allows unauthenticated file uploa

Reporter	Title	Published	Views	Family All 27
zdt	WordPress Workreap 2.2.2 Shell Upload Exploit	12 Jun 202300:00	–	zdt
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Amentotech Workreap	28 Jan 202611:34	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Amentotech Workreap	29 Sep 202304:53	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Amentotech Workreap	12 Sep 202112:43	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Amentotech Workreap	12 Sep 202112:43	–	githubexploit
attackerkb	CVE-2021-24499	9 Aug 202110:15	–	attackerkb
Circl	CVE-2021-24499	27 Apr 202309:58	–	circl
CNNVD	WordPress code issues and vulnerabilities	9 Aug 202100:00	–	cnnvd
Check Point Advisories	WordPress Workreap Theme Remote Code Execution (CVE-2021-24499)	28 Nov 202100:00	–	checkpoint_advisories
Cvelist	CVE-2021-24499 Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution	9 Aug 202100:00	–	cvelist

NVD

Vulners

Node

amentotech workreapRange<2.2.2wordpress

[
  {
    "vendor": "Unknown",
    "product": "Workreap",
    "versions": [
      {
        "version": "2.2.2",
        "status": "affected",
        "lessThan": "2.2.2",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/172876/WordPress-Workreap-2.2.2-Shell-Upload.html
jetpack	www.jetpack.com/2021/07/07/multiple-vulnerabilities-in-workreap-theme/
wpscan	www.wpscan.com/vulnerability/74611d5f-afba-42ae-bc19-777cdf2808cb

Parameter	Position	Path	Description	CWE
action=workreap_award_temp_file_uploader	query param	/wp-admin/admin-ajax.php	Unauthenticated file upload via AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader. The endpoints do not perform nonce checks or user validation, allowing arbitrary file uploads to the uploads/workreap-temp directory.	CWE-434
action=workreap_temp_file_uploader	query param	/wp-admin/admin-ajax.php	Unauthenticated file upload via AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader. The endpoints do not perform nonce checks or user validation, allowing arbitrary file uploads to the uploads/workreap-temp directory.	CWE-434

17 Jun 2026 03:40Current

8.2High risk

Vulners AI Score8.2

CVSS 27.5

CVSS 3.19.8

EPSS0.60113