The Workreap plugin for WordPress allows attackers to bypass authentication by invoking the workreap_verify_user_account routine with a target’s email address. The plugin does not confirm that the user’s confirmation_key has already been set before logging them in, a flaw that falls under CWE‑288 broken authentication. Attackers who know a registered user’s email can therefore log in as that user, including administrators, if the confirmation_key has not yet been set. This enables full compromise of the victim’s account and potentially the entire site.

Versions of the AmentoTech Workreap plugin up to and including 3.3.1 are affected. The plugin is bundled with the Workreap – Freelance Marketplace WordPress Theme, so any WordPress installation running these plugin versions is vulnerable. No later versions are known to be impacted.

The CVSS score of 9.8 indicates a critical risk level, while an EPSS score of 1% suggests a low‑to‑moderate likelihood of active exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires no special privileges; it only needs the attacker’s knowledge of a user’s email address and that the confirmation_key remains unset. The likely attack vector is a web request to the publicly exposed workreap_verify_user_account endpoint, making the vulnerability straightforward to exploit for unauthenticated attackers.