Read the docs
TI-2021-06787 Aliases CVE-2021-24500GHSA-x298-h85x-h99q

Workreap theme < 2.2.2 - Multiple CSRF + IDOR Vulnerabilities

Priority LOW 36CWE-283Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass, Tampering
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284 and CWE-352.

Summary

Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that were not validated. This allows an attacker to trick a logged in user to submit a POST request to the vulnerable site, potentially modifying or deleting arbitrary objects on the target site.

Why it matters now

EPSS 0.00646 51st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Workreap (Unknown): 2.2.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWorkreap2.2.2 to before 2.2.22.2.2Patch availableCNA
  • Workreap VendorUnknown Affected 2.2.2 to before 2.2.2 Fixed in 2.2.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:amentotech:workreap:*:*:*:*:*:wordpress:*:*before 2.2.2VulnerableAmentoTech
  • cpe:2.3:a:amentotech:workreap:*:*:*:*:*:wordpress:*:* Versions before 2.2.2 Vulnerable ·AmentoTech

Remediation

  • Fix · CNA Workreap (Unknown) Fixed in 2.2.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Workreap 2.2.2

    3 records Highest priority Priority HIGH 1 HIGH, 2 LOW

    Other records, highest priority first

    • TI-2021-06786 Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code ExecutionPriority HIGH 76
    • TI-2021-06788 Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax ActionsPriority LOW 38
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24500
  2. 2026-10-03 Alias added: GHSA-x298-h85x-h99q
  3. 2026-10-20 EPSS moved to the 50th–90th percentile

References

Exploit 2

  • TI-2021-06786 Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2022-03526 Workreap - Freelance Marketplace and Directory < 2.6.3 - Subscriber+ Private Message Disclosure via IDOR CVSS 3.1HIGH 7.5
  • TI-2022-03881 Workreap < 2.6.4 - Subscriber+ Arbitrary Posts Deletion via IDOR CVSS 3.1MEDIUM 6.5
  • TI-2025-04458 Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account' CVSS 3.1CRITICAL 9.8
  • TI-2024-12487 Workreap <= 3.2.5 - Unauthenticated Privilege Escalation via Account Takeover CVSS 3.1CRITICAL 9.8
  • TI-2025-04494 Workreap <= 3.3.2 - Authenticated (Subscriber+) Arbitrary File Upload via 'workreap_temp_upload_to_media' CVSS 3.1HIGH 8.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences