CVE-2024-13446 is an authentication bypass vulnerability in the AmentoTech Workreap WordPress plugin affecting all versions up to and including 3.2.5. The flaw arises from insufficient validation of user identity before performing social auto-login or profile updates, enabling unauthenticated attackers to log in as arbitrary users or change their passwords. This can lead to full account takeover, including administrator accounts. The vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). Although version 3.2.5 partially addresses the issue, no complete patch is confirmed.

Successful exploitation allows unauthenticated attackers to gain unauthorized access to any user account by knowing the email address, and to change passwords of arbitrary users including administrators. This results in full compromise of user accounts, potentially leading to complete site takeover, data exposure, and disruption of service. The CVSS 3.1 base score of 9.8 reflects critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Version 3.2.5 partially fixes the vulnerability, but a complete fix is not confirmed. Until an official patch is released, restrict access to the plugin and monitor for suspicious activity. Avoid using affected versions in production environments. Follow vendor communications closely for updates on a full remediation.