Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Workreap 2.2.2 Clear all filters
TI-2021-06788 CVE-2021-24501 · GHSA-jvp5-pmfj-c5g6

Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax Actions

Priority LOW 38

The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01251 Published 2021-08-09 Fixed in 2.2.2 CWE-283
TI-2021-06787 CVE-2021-24500 · GHSA-x298-h85x-h99q

Workreap theme < 2.2.2 - Multiple CSRF + IDOR Vulnerabilities

Priority LOW 36

Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that were not validated.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00646 Published 2021-08-09 Fixed in 2.2.2 CWE-283
TI-2021-06786 CVE-2021-24499 · GHSA-r7ww-r6jj-2jrh

Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

Priority HIGH 76

The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.60113 Published 2021-08-09 Fixed in 2.2.2 CWE-434