AmentoTech Workreap Core Authentication Bypass Vulnerability Allowing Account Takeover

A vulnerability allowing authentication bypass has been identified in the AmentoTech Workreap Core plugin, affecting versions through 3.4.0. This vulnerability allows unauthorized users to bypass authentication mechanisms, potentially leading to account takeover by gaining access to actions and privileges reserved for higher-level users, such as administrators.

Impact

Exploitation of this vulnerability could allow an unauthorized user to gain administrative access to a WordPress site, performing actions that could compromise the site's integrity and security.

Remediation

Users of the Workreap Core plugin are advised to update to the latest version. For those seeking immediate protection, Patchstack offers a mitigation rule that can be applied until an official fix is available.