The vulnerability in the Workreap Core plugin allows an authenticated employer or sales representative to upload arbitrary files. Because the plugin does not validate the file type, a malicious actor could upload a PHP or other executable script, potentially leading to remote code execution on the server. This weakness corresponds to the common vulnerability enumeration CWE-434, indicating an improper file type validation flaw.

The issue affects AmentoTech’s Workreap Core plugin on WordPress installations, specifically all releases up to and including version 3.4.5. Users running any of these versions are at risk if they permit employer or sales representative roles to upload files.

This flaw carries a CVSS score of 9.9, reflecting a high likelihood of severe impact if exploited. EPSS score of 0.00479, indicating a very low but non-zero likelihood of exploitation, but the lack of a KEV listing suggests it has not yet been widely observed in the wild. The attack vector is likely a remote upload via the plugin’s file upload endpoint, requiring an authenticated user with appropriate roles. If the uploader can place a script in a web-accessible location, the attacker can execute it, hijack the site, or further pivot into the network.