Privilege Escalation in Workreap Plugin for WordPress

CVE-2024-13446

What is CVE-2024-13446?

The Workreap plugin for WordPress contains a vulnerability that allows unauthenticated attackers to execute privilege escalation through account takeover. This occurs because the plugin fails to adequately verify user identities before conducting social auto-login actions or updating profile details. Attackers can exploit this flaw to log in as any user by simply knowing their email address or to modify an arbitrary user's password, which could include administrators. Though the issue was partially addressed in version 3.2.5, risk remains for earlier versions.

References