CVE-2024-13446

The plugin does not properly validate user identity before performing two operations: automatic login via social account (social auto-login) and profile data updates, including password changes. An attacker who knows the victim's email address can log into their account without providing a password by using the social auto-login mechanism. Alternatively, an attacker can change the password of any user — including an administrator — without authentication, and then gain full access to the account.

An unauthenticated attacker can take control of any WordPress user account, including administrator accounts, resulting in complete compromise of the website's confidentiality, integrity, and availability.

Apply patches available from the vendor according to the references. Version 3.2.5 contains only a partial fix — it is recommended to monitor updates released by Amentotech and apply the fully patched version as soon as it becomes available.

Workreap plugin for WordPress in all versions up to and including 3.2.5. Note: in version 3.2.5, the vulnerability has been fixed only partially.