WordPress theme

Workreap <= 2.6.3 — Insecure Direct Object Reference

CVE-2022-4239Published Dec 2, 2022 · Updated Nov 13, 2026

Affected: ≤2.6.3Update to 2.6.4 or newer

All remediation steps

Watch theme

Medium5.4CVSS 3.15.4CISA KEVNot listedAccessUnknown

On this page3

Overview

Advisory ID: CVE-2022-4239
Product: Workreap - Freelance Marketplace and Directory WordPress Theme workreap
Affected: ≤2.6.3
Fixed in: 2.6.4
Weakness: CWE-639 Authorization Bypass Through User-Controlled Key
Required access: Unknown
Published: Dec 2, 2022 · updated Nov 13, 2026
Credit: Veshraj Ghimire
Source: Wordfence Intelligence

Affected≤ 2.6.3
Patched in2.6.4

5.4

CVSS 3.1 · CNA (Wordfence)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

What does this vector mean?

AV:N Attack vector: Network
AC:L Attack complexity: Low
PR:L Privileges required: Low
UI:N User interaction: None
S:U Scope: Unchanged
C:N Confidentiality: None
I:L Integrity: Low
A:L Availability: Low

The Workreap theme for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 2.6.3. This is due to missing validation on if an addon service belongs to an individual making a request to the workreap_addons_service_remove action. This makes it possible for authenticated attackers to call arbitrary addon services and delete posts.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

Update to version 2.6.4, or a newer patched version
Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.

References & provenance

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

Advisorywordfence.com

Related CVEs

More vulnerabilities in Workreap - Freelance Marketplace and Directory WordPress Theme
Severity	Vulnerability	CVE	Published
Medium5.4	Insecure Direct Objection Reference to Private Message Disclosure <2.6.3Update to 2.6.3	CVE-2022-3846	Nov 12, 2022
Critical9.8	Freelance Marketplace and Directory WordPress Theme < 2.2.2 - Arbitrary File Upload <2.2.2Update to 2.2.2	CVE-2021-24499	Jul 2, 2021
High8.1	Cross-Site Request Forgery <2.2.2Update to 2.2.2	CVE-2021-24500	Jul 2, 2021
High8.1	Authorization Bypass <2.2.2Update to 2.2.2	CVE-2021-24501	Jun 29, 2021

Medium5.4
Insecure Direct Objection Reference to Private Message Disclosure
<2.6.3Update to 2.6.3
CVE-2022-3846Nov 12, 2022
Critical9.8
Freelance Marketplace and Directory WordPress Theme < 2.2.2 - Arbitrary File Upload
<2.2.2Update to 2.2.2
CVE-2021-24499Jul 2, 2021
High8.1
Cross-Site Request Forgery
<2.2.2Update to 2.2.2
CVE-2021-24500Jul 2, 2021
High8.1
Authorization Bypass
<2.2.2Update to 2.2.2
CVE-2021-24501Jun 29, 2021

Timeline

Dec 2, 2022
CVE published
Severity medium, CVSS 5.4
Nov 13, 2026
Record last updated

Sources & licenses

Wordfence record

Vulnerability data: Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Licensed under the CC BY-SA 4.0.
CVE® identifiers: Copyright 1999-2026 The MITRE Corporation. Used under the CVE Program. CVE® is a registered trademark of The MITRE Corporation.
CVSS / CWE: National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.

How we use these sources