Vulnerability · Published Aug 9, 2021 · Assigned by WPScan
CVE-2021-24499Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution
Critical 9.8
In plain English
A critical-severity unrestricted file upload in Workreap from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 60.1% (higher than 99.1% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Official description
The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were neither sanitized nor validated, allowing an unauthenticated visitor to upload executable code such as php scripts.
Affected products (as reported)
Weakness: CWE-434