CVE-2021-24499

The CVE affects WordPress Workreap theme prior to 2.2.2. The AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader do not perform nonce checks or validate the requester, allowing unauthenticated uploads to uploads/workreap-temp. Uploaded files were not sanitized, enabling...

CVE-2022-4239

The vulnerability CVE-2022-4239 affects the Workreap WordPress theme prior to 2.6.4. It arises from the addon service removal path (workreap_addons_service_remove) not verifying ownership or the existence of an addon service, enabling an authenticated user to delete arbitrary posts by guessing th...

CVE-2025-5012

CVE-2025-5012 affects the WordPress Workreap plugin (WordPress theme: Workreap - Freelance Marketplace) up to version 3.3.2. The vulnerability is an arbitrary file upload flaw caused by missing file type validation in the function workreap_temp_upload_to_media , exploitable by authenticated users...

CVE-2025-4973

CVE-2025-4973: The Workreap WordPress plugin (Workreap theme) is vulnerable to authentication bypass in versions up to 3.3.1. The flaw stems from improper verification of a user’s identity during email-based account verification, enabling unauthenticated attackers to log in as registered users (i...

CVE-2022-3846

CVE-2022-3846 affects the Workreap WordPress theme prior to version 2.6.3. The vulnerability arises in the notifications feature, where the notification ID is brute-forcable, allowing an attacker to read any user’s notifications (employer or freelancer). Public details in connected documents show...

CVE-2024-13446

CVE-2024-13446 affects the WordPress Workreap plugin (versions up to and including 3.2.5). The entry describes an unauthenticated privilege-escalation via account takeover caused by insufficient identity validation before (1) social auto-login or (2) updating profile details (e.g., password). As ...

CVE-2021-24500

CVE-2021-24500 affects the WordPress Workreap theme prior to 2.2.2. The vulnerability arises from several AJAX actions lacking CSRF protections and insecure direct object references (IDOR), enabling a logged-in attacker to submit POST requests that could modify or delete arbitrary objects on the ...

CVE-2021-24501

Summary of the CVE-2021-24501 (Workreap theme ≤ 2.2.2) : The WordPress Workreap theme versions prior to 2.2.2 expose missing authorization checks in several AJAX actions, enabling an authenticated (logged-in) user to modify or delete objects owned by other users. The issue arises in AJAX handlers...