HIGH🇵🇱 Wersja polska

CVE-2022-3846

CVSS 7.5v3.1pub. 2022-12-05upd. 2025-04-23

The Workreap WordPress theme before 2.6.3 has a vulnerability with the notifications feature as it's possible to read any user's notification (employer or freelancer) as the notification ID is brute-forceable.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Amentotech Workreap

    APP
    Amentotech
    < 2.6.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
References

Related vulnerabilities

CVE-2025-4973CRITICAL9.8PL ✓ten sam produkt

Authentication Bypass w pluginie Workreap dla WordPress (do wersji 3.3.1)

CVE-2024-13446CRITICAL9.8PL ✓ten sam produkt

Workreap WordPress Plugin — przejęcie konta i eskalacja uprawnień

CVE-2021-24499CRITICAL9.8ten sam produkt

The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_fil...

CVE-2025-5012HIGH8.8ten sam produkt

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable...

CVE-2021-24500HIGH8.1ten sam produkt

Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well a...