This flaw permits an attacker to bypass normal authentication by using an alternate path or channel, enabling them to act as any user on the WordPress site. The vulnerability is a CWE‑288 weakness that undermines the confidentiality, integrity, and availability of the site, potentially giving an attacker full control over content, settings, and user credentials.

Any WordPress installation that has the AmentoTech Workreap Core plugin installed with a version no newer than 3.4.1. No specific build identifiers beyond the stated maximum are provided, so the issue applies to all releases up to and including 3.4.1.

The CVSS score of 9.8 classifies the vulnerability as Critical, indicating that successful exploitation could grant an attacker administrative privileges over the affected site. The EPSS score of less than 1% suggests a currently low probability of exploitation, but the lack of targeted detection means that an attacker could still succeed if they can reach the plugin’s authentication endpoints. The attack vector is inferred to be network‑based via HTTP requests to the plugin’s alternate authentication path, as the description indicates an alternate channel; this inference is not directly stated in the CVE record.