Authentication Bypass Vulnerability in AmentoTech Workreap Core Plugin
CVE-2025-69101

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Workreap Core
Vendor
CVE Published:
22 January 2026

What is CVE-2025-69101?

An authentication bypass vulnerability has been identified in the AmentoTech Workreap Core plugin. This flaw allows attackers to exploit an alternate path or channel to bypass authentication mechanisms, leading to potential unauthorized access and account takeover for users. The issue affects versions of Workreap Core through version 3.4.0, making it crucial for users to update to a secure version and mitigate risks associated with this vulnerability.

Affected Version(s)

Workreap Core 0 <= 3.4.1

References

https://patchstack.com/database/Wordpress/Plugin/workreap...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

NAWardRox | Patchstack Bug Bounty Program
.