CVE-2025-5012: Amentotech Workreap RCE Vulnerability

CVE-2025-5012 Overview

CVE-2025-5012 is an arbitrary file upload vulnerability in the Workreap plugin for WordPress, which powers the Workreap Freelance Marketplace WordPress Theme by Amentotech. The flaw resides in the workreap_temp_upload_to_media function, which fails to validate file types before accepting uploads. All versions up to and including 3.3.2 are affected. Authenticated attackers with Subscriber-level access or higher can upload arbitrary files to the affected server, potentially leading to remote code execution. The vulnerability is categorized under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated Subscriber-level attackers can upload arbitrary files, including PHP webshells, achieving remote code execution on affected WordPress sites.

Affected Products

Amentotech Workreap plugin versions up to and including 3.3.2
Workreap Freelance Marketplace WordPress Theme bundling the affected plugin
WordPress sites with Subscriber registration enabled using the Workreap plugin

Discovery Timeline

2025-06-12 - CVE-2025-5012 published to NVD
2025-07-10 - Last updated in NVD database

Technical Details for CVE-2025-5012

Vulnerability Analysis

The Workreap plugin exposes the workreap_temp_upload_to_media function, which handles temporary file uploads to the WordPress media library. The function processes uploaded files without enforcing MIME type checks or extension allowlists. Any authenticated user with at least Subscriber privileges can invoke the endpoint and submit files with dangerous extensions such as .php, .phtml, or .phar.

WordPress sites running the Workreap Freelance Marketplace theme typically allow open user registration so freelancers and employers can sign up. This dramatically lowers the bar for exploitation. Once a malicious file lands in a web-accessible directory, the attacker requests it directly to trigger server-side code execution. From there, the adversary can establish persistence, pivot laterally, or exfiltrate data from the underlying host and database.

Root Cause

The root cause is missing input validation on uploaded file types in the workreap_temp_upload_to_media handler. The function does not enforce a server-side allowlist of permitted MIME types or extensions. It also fails to leverage WordPress core helpers such as wp_check_filetype_and_ext() that would block executable content. This omission falls squarely within [CWE-434].

Attack Vector

Exploitation requires only a valid Subscriber account, which is trivially obtained on freelance marketplace deployments. The attacker authenticates, submits a crafted multipart upload to the vulnerable endpoint, and references the resulting file URL to execute code. No user interaction is required beyond the attacker's own session. Detailed technical analysis is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-5012

Indicators of Compromise

Unexpected .php, .phtml, .phar, or .htaccess files in WordPress wp-content/uploads/ subdirectories
HTTP POST requests to admin-ajax endpoints invoking the workreap_temp_upload_to_media action from low-privilege user sessions
Outbound network connections from the PHP-FPM or web server process to attacker-controlled infrastructure
New or modified WordPress administrator accounts following suspicious upload activity

Detection Strategies

Monitor web server access logs for POST requests containing the workreap_temp_upload_to_media action parameter
Audit the WordPress media library for files with executable extensions or polyglot content
Inspect file integrity baselines on the wp-content/uploads/ directory for unauthorized additions
Correlate Subscriber-level authentication events with subsequent file upload activity

Monitoring Recommendations

Enable verbose logging on the WordPress admin-ajax.php endpoint and forward logs to a centralized SIEM
Alert on PHP execution originating from any path under wp-content/uploads/
Track creation of new low-privilege accounts followed by upload requests within short time windows
Review WordPress audit logs for plugin actions invoked by non-administrative roles

How to Mitigate CVE-2025-5012

Immediate Actions Required

Update the Workreap plugin to version 3.3.3 or later, released alongside the Workreap theme update on 6 June 2025
Audit existing uploads under wp-content/uploads/ for unauthorized executable files and remove them
Disable open user registration temporarily if the plugin cannot be patched immediately
Rotate WordPress administrator credentials and review the user table for unexpected accounts

Patch Information

Amentotech addressed the vulnerability in Workreap version 3.3.3. Refer to the ThemeForest Item Release Note for the official changelog. Site administrators should update through the ThemeForest dashboard or by replacing the plugin files manually with the latest distribution package.

Workarounds

Restrict Subscriber-level account creation through CAPTCHA and email verification until the patch is applied
Configure the web server to deny PHP execution within wp-content/uploads/ using .htaccess or equivalent Nginx rules
Deploy a web application firewall rule blocking POST requests to the workreap_temp_upload_to_media action with disallowed file extensions
Apply strict file extension allowlisting at the reverse proxy layer for any upload endpoints

bash

# Nginx configuration example to block PHP execution in uploads directory
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9])$ {
    deny all;
    return 403;
}