PT-2021-16022 · WordPress · Workreap

Harald Eilertsen · Published 2021-08-09 · Updated 2022-10-25 · CVE-2021-24500

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Workreap WordPress theme versions prior to 2.2.2

Description The issue allows an attacker to trick a logged-in user into submitting a POST request to the vulnerable site, potentially modifying or deleting arbitrary objects on the target site. This is due to several AJAX actions lacking CSRF protections and allowing insecure direct object references that were not validated.

Recommendations For Workreap WordPress theme versions prior to 2.2.2, update to version 2.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the AJAX actions until the update is applied.

Exploit

Fix

Improper Access Control

Missing Authorization

CSRF

Weakness Enumeration

CWE-283

CWE-284

CWE-862

CWE-352

Related Identifiers

CVE-2021-24500

Affected Products

Workreap

References · 4

• 🔥 https://wpscan.com/vulnerability/0c4b5ecc-54d0-45ec-9f92-b2ca3cadbe56 · Exploit
• 🔥 https://jetpack.com/2021/07/07/multiple-vulnerabilities-in-workreap-theme · Exploit
• https://osv.dev/vulnerability/CVE-2021-24500 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24500 · Security Note