CVE-2021-24499 Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

What is CVE-2021-24499?

CVE-2021-24499 is a critical vulnerability in Unknown Workreap, published on 9 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were neither sanitized nor validated, allowing an unauthenticated visitor to upload executable code such as php scripts.

Weakness: CWE-434

Which versions are affected by CVE-2021-24499?

It affects 1 product.

Products include Amentotech Workreap.

How do I fix CVE-2021-24499?

No fix has been published for CVE-2021-24499 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-24499 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-24499 exists.

Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 4 proofs of concept on GitHub.

Other vulnerabilities in Unknown Workreap

• CVE-2025-4973 Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account' Critical 9.8
• CVE-2024-13446 Workreap <= 3.2.5 - Unauthenticated Privilege Escalation via Account Takeover Critical 9.8
• CVE-2025-5012 Workreap <= 3.3.2 - Authenticated (Subscriber+) Arbitrary File Upload via 'workreap_temp_upload_to_media' High 8.8
• CVE-2021-24500 Workreap theme < 2.2.2 - Multiple CSRF + IDOR Vulnerabilities High 8.1
• CVE-2021-24501 Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax Actions High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r7ww-r6jj-2jrh.