Workreap

Workreap has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; 4 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 8.6, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 2 high. 2025 was the busiest year with 4 disclosures.

The most common weakness is Authentication Bypass Using An Alternate Path Or Channel, behind 2 of the records (40%). Other recurring categories include Path Traversal, SQL Injection.

4 of the records (80%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

4 independent researchers contributed these findings, most of them (2) reported by Foxyyy.

01234567891011.03.2025Today11.03.20259.8Workreap <= 3.2.5 - Unauthenticated Privilege Escalation via Account Takeover CVSS 9.8 · 11.03.202511.06.20258.8Workreap <= 3.3.2 - Authenticated (Subscriber+) Arbitrary File Upload via 'workreap_temp_upload_to_media' CVSS 8.8 · 11.06.20259.8Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account' CVSS 9.8 · 11.06.202526.09.20258.1Workreap <= 3.3.5 - Authenticated (Subscriber+) Arbitrary File Deletion CVSS 8.1 · 26.09.202508.01.20266.5Workreap (theme's plugin) <= 3.3.6 - Authenticated (Subscriber+) SQL Injection CVSS 6.5 · 08.01.2026

Strategic Overview

Avg CVSSHigh
8.6/ 10
Patch Coverage80%
Open

1

Fixed

4

Get automatic notifications for all Workreap vulnerabilities before they are exploited.

Most severe open issueCVSS 6.5CVE-2025-22728

Workreap (theme's plugin) <= 3.3.6 - Authenticated (Subscriber+) SQL Injection

Read the full analysis

Vulnerability Records

5 records
Showing 1–5 of 5 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C