Vulnerability · Published Aug 9, 2021 · Assigned by WPScan
CVE-2021-24500Workreap theme < 2.2.2 - Multiple CSRF + IDOR Vulnerabilities
High 8.1
In plain English
A high-severity improper access control in Workreap from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Severity (CVSS NVD)8.1High
Exploit odds (30 days)0.6%top 48.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that were not validated. This allows an attacker to trick a logged in user to submit a POST request to the vulnerable site, potentially modifying or deleting arbitrary objects on the target site.
Affected products (as reported)
Weakness: CWE-283, CWE-284, CWE-862