CVE-2024-13446 Workreap <= 3.2.5 - Unauthenticated Privilege Escalation via Account Takeover
Unauthenticated attackers can take over arbitrary user accounts, including administrators, by bypassing identity validation during social auto-login or profile updates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-13446?
CVE-2024-13446 is a critical authentication bypass vulnerability in AmentoTech Workreap, published on 12 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Workreap plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.2.5. This is due to the plugin not properly validating a user's identity prior to (1) performing a social auto-login or (2) updating their profile details (e.g. password). This makes it possible for unauthenticated attackers to (1) login as an arbitrary user if their email address is known or (2) change an arbitrary user's password, including administrators, and leverage that to gain access to their account. NOTE: This vulnerability was partially fixed in version 3.2.5.
Weakness: CWE-288
Which versions are affected by CVE-2024-13446?
It affects 1 product.
Products include Amentotech Workreap.
How do I fix CVE-2024-13446?
No fix has been published for CVE-2024-13446 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-13446 being exploited?
There is no known exploitation of CVE-2024-13446 in the wild and no public exploit code.
Other vulnerabilities in AmentoTech Workreap
- CVE-2025-4973 Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account'
- CVE-2021-24499 Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution
- CVE-2025-5012 Workreap <= 3.3.2 - Authenticated (Subscriber+) Arbitrary File Upload via 'workreap_temp_upload_to_media'
- CVE-2021-24500 Workreap theme < 2.2.2 - Multiple CSRF + IDOR Vulnerabilities
- CVE-2021-24501 Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax Actions
Sources
Also known as GHSA-jmq5-mqx2-5f5c.