CVE-2025-4973 Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account'
Unauthenticated attackers can log in as registered users, including administrators, if the user's confirmation key is unset.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-4973?
CVE-2025-4973 is a critical authentication bypass vulnerability in AmentoTech Workreap, published on 12 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an account with an email address. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they know user's email address. This is only exploitable fi the user's confirmation_key has not already been set by the plugin.
Weakness: CWE-288
Which versions are affected by CVE-2025-4973?
It affects 1 product.
Products include Amentotech Workreap.
How do I fix CVE-2025-4973?
No fix has been published for CVE-2025-4973 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-4973 being exploited?
There is no known exploitation of CVE-2025-4973 in the wild and no public exploit code.
Other vulnerabilities in AmentoTech Workreap
- CVE-2024-13446 Workreap <= 3.2.5 - Unauthenticated Privilege Escalation via Account Takeover
- CVE-2021-24499 Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution
- CVE-2025-5012 Workreap <= 3.3.2 - Authenticated (Subscriber+) Arbitrary File Upload via 'workreap_temp_upload_to_media'
- CVE-2021-24500 Workreap theme < 2.2.2 - Multiple CSRF + IDOR Vulnerabilities
- CVE-2021-24501 Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax Actions
Sources
Also known as GHSA-q5jm-5p84-m8rp.