CVE-2025-4973

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-4973", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-20T00:13:58.960Z", "datePublished": "2025-06-12T05:23:39.978Z", "dateUpdated": "2026-04-08T17:06:22.730Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:22.730Z"}, "affected": [{"vendor": "AmentoTech", "product": "Workreap", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an account with an email address. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they know user's email address. This is only exploitable fi the user's confirmation_key has not already been set by the plugin."}], "title": "Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8e7693a3-642a-4eff-902c-d29a3c12deb0?source=cve"}, {"url": "https://themeforest.net/item/workreap-freelance-marketplace-wordpress-theme/23712454#item-description__release-3-3-2-23-may-2025"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel", "cweId": "CWE-288", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Friderika Baranyai"}], "timeline": [{"time": "2025-06-11T16:31:01.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-12T13:07:13.179819Z", "id": "CVE-2025-4973", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-12T13:07:20.510Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-4973", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-12T13:07:13.179819Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-12T13:07:17.140Z"}}], "cna": {"title": "Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account'", "credits": [{"lang": "en", "type": "finder", "value": "Friderika Baranyai"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "AmentoTech", "product": "Workreap", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.3.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-11T16:31:01.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8e7693a3-642a-4eff-902c-d29a3c12deb0?source=cve"}, {"url": "https://themeforest.net/item/workreap-freelance-marketplace-wordpress-theme/23712454#item-description__release-3-3-2-23-may-2025"}], "descriptions": [{"lang": "en", "value": "The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an account with an email address. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they know user's email address. This is only exploitable fi the user's confirmation_key has not already been set by the plugin."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:22.730Z"}}}, "cveMetadata": {"cveId": "CVE-2025-4973", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:06:22.730Z", "dateReserved": "2025-05-20T00:13:58.960Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-12T05:23:39.978Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Workreap", "vendor": "AmentoTech", "versions": [{"lessThanOrEqual": "3.3.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:amentotech:workreap:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "31576DC9-3E2E-434E-9CD5-67E4963C16AF", "versionEndExcluding": "3.3.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an account with an email address. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they know user's email address. This is only exploitable fi the user's confirmation_key has not already been set by the plugin."}, {"lang": "es", "value": "El complemento Workreap para WordPress, utilizado por el tema Workreap - Freelance Marketplace para WordPress, es vulnerable a la omisi\u00f3n de la autenticaci\u00f3n en todas las versiones hasta la 3.3.1 incluida. Esto se debe a que el complemento no verifica correctamente la identidad del usuario antes de iniciar sesi\u00f3n al verificar una cuenta con una direcci\u00f3n de correo electr\u00f3nico. Esto permite que atacantes no autenticados inicien sesi\u00f3n como usuarios registrados, incluidos administradores, si conocen la direcci\u00f3n de correo electr\u00f3nico del usuario. Esto solo es explotable si el complemento no ha configurado previamente la clave de confirmaci\u00f3n del usuario."}], "id": "CVE-2025-4973", "lastModified": "2026-06-17T09:34:25.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-4973", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-06-12T13:07:13.179819Z", "version": "2.0.3"}}]}, "published": "2025-06-12T06:15:23.440", "references": [{"source": "security@wordfence.com", "tags": ["Release Notes"], "url": "https://themeforest.net/item/workreap-freelance-marketplace-wordpress-theme/23712454#item-description__release-3-3-2-23-may-2025"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8e7693a3-642a-4eff-902c-d29a3c12deb0?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T01:23:27.989547+00:00", "value": {"mitigation_remediation": ["Upgrade the Workreap plugin to version 3.3.2 or later, where the authentication bypass has been fixed.", "If an immediate upgrade is not possible, restrict access to the workreap_verify_user_account endpoint through web\u2011server rules or a security plugin, preventing public exploitation.", "Ensure that all existing user accounts have had their confirmation_key set by completing any pending email confirmations; accounts that already have a confirmation key are no longer vulnerable."], "summary": {"action": "Immediate Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "Versions of the AmentoTech Workreap plugin up to and including 3.3.1 are affected. The plugin is bundled with the Workreap \u2013 Freelance Marketplace WordPress Theme, so any WordPress installation running these plugin versions is vulnerable. No later versions are known to be impacted.", "description_and_impact": "The Workreap plugin for WordPress allows attackers to bypass authentication by invoking the workreap_verify_user_account routine with a target\u2019s email address. The plugin does not confirm that the user\u2019s confirmation_key has already been set before logging them in, a flaw that falls under CWE\u2011288 broken authentication. Attackers who know a registered user\u2019s email can therefore log in as that user, including administrators, if the confirmation_key has not yet been set. This enables full compromise of the victim\u2019s account and potentially the entire site.", "risk_and_exploitability": "The CVSS score of 9.8 indicates a critical risk level, while an EPSS score of 1% suggests a low\u2011to\u2011moderate likelihood of active exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires no special privileges; it only needs the attacker\u2019s knowledge of a user\u2019s email address and that the confirmation_key remains unset. The likely attack vector is a web request to the publicly exposed workreap_verify_user_account endpoint, making the vulnerability straightforward to exploit for unauthenticated attackers."}}}}, "created": "2026-04-22T01:30:05.234850+00:00", "updated": "2026-04-22T01:30:05.234865+00:00", "vendors": []}