Authentication Bypass in Workreap Plugin for WordPress

CVE-2025-4973

What is CVE-2025-4973?

The Workreap plugin for WordPress, utilized by the Workreap - Freelance Marketplace theme, features a significant vulnerability allowing unauthenticated attackers to bypass authentication processes. This vulnerability stems from improper verification of user identities when attempting to log in via email verification. Attackers can exploit this flaw to gain access as legitimate users, including administrators, provided they know the email address of the user and the confirmation_key has not been established. This vulnerability affects all versions of the plugin up to and including 3.3.1, highlighting the critical need for users to update their installations immediately.

References