CVE-2024-13446
📋 TL;DR
The Workreap WordPress plugin allows unauthenticated attackers to take over any user account, including administrators, by exploiting insufficient identity validation during social auto-login and profile updates. This affects all WordPress sites using Workreap versions up to 3.2.5. Attackers can gain full control of vulnerable sites.
💻 Affected Systems
- Workreap WordPress Plugin
📦 What is this software?
Workreap by Amentotech
⚠️ Risk & Real-World Impact
Worst Case
Complete site compromise with administrative access, data theft, malware injection, and defacement.
Likely Case
Administrative account takeover leading to site modification, plugin/theme installation, and user data exposure.
If Mitigated
Limited impact if strong network controls, WAF rules, and monitoring prevent exploitation attempts.
🎯 Exploit Status
Attack requires only knowledge of target email address. No authentication needed. Simple HTTP requests can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 3.2.5
Vendor Advisory: https://themeforest.net/item/workreap-freelance-marketplace-wordpress-theme/23712454
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Workreap plugin. 4. Click 'Update Now' if update available. 5. If no update available, disable or remove plugin immediately.
🔧 Temporary Workarounds
Disable Workreap Plugin
allTemporarily disable the vulnerable plugin until patched version is available.
wp plugin deactivate workreap
Web Application Firewall Rule
allBlock requests to Workreap-specific endpoints that handle social login and profile updates.
🧯 If You Can't Patch
- Remove Workreap plugin completely and use alternative functionality
- Implement IP whitelisting for WordPress admin area and restrict access to known IPs only
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Workreap version 3.2.5 or earlier.Check Version:
wp plugin get workreap --field=versionVerify Fix Applied:
Verify Workreap plugin version is higher than 3.2.5 in WordPress admin plugins page.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication events for multiple users
- Failed login attempts followed by successful logins from same IP
- POST requests to /wp-admin/admin-ajax.php with workreap-related actions
Network Indicators:
- HTTP requests to Workreap-specific endpoints from unexpected IPs
- Multiple account takeover attempts within short timeframes
SIEM Query:
source="wordpress.log" AND ("workreap" AND ("social_login" OR "update_profile")) AND response_code=200