Workreap Theme < 2.2.2 - Authorization Bypass

The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a logged in user to modify or delete objects belonging to other users on the site.

Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: Workreap - Freelance Marketplace and Directory WordPress Theme 2.2.2 closes this, and updating the theme is the step that ends it.

• Login Security
• Alerts