Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4.
Published: 2026-10-22
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: SQL Injection
Action: Immediate Patch
AI Analysis

Impact

The vulnerability originates from improper neutralization of special elements in SQL commands, enabling a blind SQL injection attack. An attacker can read, modify, or delete data stored in the WordPress database, potentially exposing sensitive information or damaging site integrity. This weakness is classified as CWE‑89.

Affected Systems

The affected product is AmentoTech Workreap Core for WordPress when its version is earlier than 3.4.4. WordPress sites that include this plugin without updating to version 3.4.4 or later are at risk, while all other products are not listed as affected.

Risk and Exploitability

The CVSS score of 8.5 indicates high severity, yet the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be through web input fields provided by the plugin, allowing blind SQL injection. An attacker would need access to the site’s web interface to supply crafted input, after which they could exfiltrate or alter stored data. Remediation remains critical.

Generated by OpenCVE AI on October 22, 2026 at 12:51 UTC.

Remediation

Vendor Solution

Update the WordPress Workreap Core plugin to the latest available version (at least 3.4.4).

OpenCVE Recommended Actions

  • Update the Workreap Core plugin to version 3.4.4 or later, which removes the vulnerability.
  • If an immediate update cannot be performed, deactivate or remove the plugin to eliminate the attack surface until the patch is available.
  • Ensure the database account used by WordPress has the least privileges necessary; restricting permissions limits the damage an attacker could cause if injection succeeds.

Generated by OpenCVE AI on October 22, 2026 at 12:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 11:15:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4.
Title WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-22T13:37:46.663Z

Reserved: 2026-10-19T19:23:59.817Z

Link: CVE-2026-112822

cve-icon Vulnrichment

Updated: 2026-10-22T13:32:28.994Z

cve-icon NVD

Status : Deferred

Published: 2026-10-22T11:17:32.113

Modified: 2026-10-22T15:15:23.833

Link: CVE-2026-112822

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T13:00:07Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')