Workreap WordPress Plugin Authentication Bypass Vulnerability

A vulnerability allowing authentication bypass has been identified in the Workreap plugin for WordPress, specifically in versions through 3.3.1. This issue arises because the plugin fails to properly verify a user's identity before logging them in during the account verification process via email. As a result, unauthenticated attackers can log in as registered users, including administrators, if they know the user's email address. This vulnerability is exploitable only if the user's confirmation_key has not been set by the plugin.

Impact

Exploitation of this vulnerability allows for authentication bypass, enabling attackers to log in as registered users, including administrators.

Remediation

Users can update to version 3.3.2 or a newer patched version to address this vulnerability.