CVE-2025-4973: Workreap WordPress Authentication Bypass

CVE-2025-4973 Overview

CVE-2025-4973 is an authentication bypass vulnerability in the Workreap plugin for WordPress, which powers the Workreap Freelance Marketplace WordPress Theme. The flaw affects all versions up to and including 3.3.1. The plugin fails to properly verify a user's identity during the email-based account confirmation flow. Unauthenticated attackers can log in as any registered user, including administrators, if they know the target's email address. Exploitation requires that the user's confirmation_key has not yet been set by the plugin. The issue is tracked under [CWE-288] (Authentication Bypass Using an Alternate Path or Channel).

Critical Impact
Unauthenticated attackers can take over administrator accounts on affected WordPress sites with knowledge of only an email address, leading to full site compromise.

Affected Products

Amentotech Workreap plugin versions up to and including 3.3.1
Workreap Freelance Marketplace WordPress Theme (bundled plugin)
WordPress sites running the affected plugin in default configuration

Discovery Timeline

2025-06-12 - CVE-2025-4973 published to NVD
2025-07-10 - Last updated in NVD database

Technical Details for CVE-2025-4973

Vulnerability Analysis

The Workreap plugin exposes an account confirmation workflow that authenticates users by email address without enforcing a valid, server-issued confirmation token. When the plugin processes the confirmation request, it logs the user in based on inputs an unauthenticated attacker can supply. The vulnerability is reachable over the network with no privileges and no user interaction. An attacker who knows or guesses an administrator's email address can impersonate that account, modify content, install malicious plugins, and execute arbitrary PHP through standard WordPress administrator capabilities.

Root Cause

The root cause is missing identity verification in the email confirmation handler. The plugin does not require a cryptographically strong, server-generated confirmation_key to be present and matched before establishing an authenticated session. When the confirmation_key value has not yet been set for a given account, the verification check effectively passes, allowing the handler to call WordPress login functions on behalf of the target user. This is a classic alternate-channel authentication failure mapped to [CWE-288].

Attack Vector

The attack is remote and unauthenticated. An attacker sends a crafted HTTP request to the Workreap account verification endpoint, supplying the victim's email address. If the targeted account has never completed the confirmation step, the plugin issues an authenticated session for that account. Administrator email addresses are frequently discoverable through author archives, REST API endpoints such as /wp-json/wp/v2/users, contact pages, or prior data leaks. See the Wordfence Vulnerability Report for additional context.

No verified public exploit code is available for CVE-2025-4973.
Refer to the Wordfence advisory linked above for technical details
on the vulnerable confirmation flow.

Detection Methods for CVE-2025-4973

Indicators of Compromise

Unexpected administrator logins from unfamiliar IP addresses with no preceding password reset events
New WordPress administrator accounts, plugin installations, or theme file modifications not authorized by site operators
HTTP requests to Workreap account verification endpoints containing email parameters but no valid confirmation_key
Outbound requests to unknown hosts originating from the WordPress server after a suspicious admin login

Detection Strategies

Inspect web server access logs for POST or GET requests targeting Workreap verification handlers correlated with successful WordPress authentication cookies
Compare WordPress usermeta entries for confirmation_key values that were set or cleared outside of normal user registration windows
Alert on changes to the wp_users table, especially user_pass resets and role escalations to administrator
Monitor for file integrity changes in wp-content/plugins/ and wp-content/themes/ directories following login events

Monitoring Recommendations

Forward WordPress audit logs, web server logs, and PHP error logs to a centralized logging platform for correlation
Enable WordPress two-factor authentication and alert on logins that bypass the second factor
Track administrator session creation events and tie them to source IP reputation data

How to Mitigate CVE-2025-4973

Immediate Actions Required

Update the Workreap plugin to version 3.3.2 or later on every affected WordPress site
Force a password reset for all administrator and high-privilege accounts after patching
Audit the wp_users and wp_usermeta tables for unauthorized accounts and unexpected confirmation_key values
Review installed plugins, themes, and mu-plugins directories for backdoors added during the exposure window

Patch Information

Amentotech released Workreap version 3.3.2 on 23 May 2025, which addresses the authentication bypass. Site operators should consult the ThemeForest Item Release Notes for the official changelog and apply the update through the WordPress admin interface or by replacing plugin files directly.

Workarounds

Temporarily deactivate the Workreap plugin until the patch is applied
Restrict access to Workreap verification endpoints at the web application firewall or reverse proxy layer
Obscure administrator email addresses by disabling the WordPress users REST endpoint and removing author archives

bash

# Update Workreap to the patched version using WP-CLI
wp plugin update workreap --version=3.3.2

# Verify installed version
wp plugin get workreap --field=version

# Optional: disable the public users REST endpoint to limit email exposure
wp option patch insert disallow_file_edit true