CVE-2025-4973: The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the

critical Affects workreap (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2025-06-12; advisory modified 2026-06-17.

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the

Package: workreap (WordPress plugin) WordPress
Affected versions: <3.3.2
Fixed in: 3.3.2
Severity: critical CVSS 9.8
Exploitation: not on CISA KEV · EPSS 0% (41.2th percentile)
Published: 2025-06-12
Source: nvd

References

CWE-288

NVD record workreap (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2021-24499 critical The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader a same package: workreap (WordPress plugin)
CVE-2021-24501 high The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization c same package: workreap (WordPress plugin)
CVE-2022-3846 high The Workreap WordPress theme before 2.6.3 has a vulnerability with the notifications featu same package: workreap (WordPress plugin)
CVE-2021-24500 high Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF pr same package: workreap (WordPress plugin)
CVE-2022-4239 medium The Workreap WordPress theme before 2.6.4 does not verify that an addon service belongs to same package: workreap (WordPress plugin)
CVE-2025-5012 high The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress same package: workreap (WordPress plugin)