The Workreap plugin for WordPress suffers from an unrestricted file upload vulnerability (CWE-434) in the 'workreap_temp_upload_to_media' function. This vulnerability arises from the lack of proper file type validation, enabling authenticated users with low privileges (Subscriber-level and above) to upload arbitrary files to the server. Such uploads may facilitate remote code execution, compromising confidentiality, integrity, and availability of the affected system. The issue affects all versions up to 3.3.2. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an authenticated attacker with Subscriber-level access or higher to upload arbitrary files, potentially leading to remote code execution. This compromises the affected site's confidentiality, integrity, and availability. Given the CVSS score of 8.8, the impact is high, posing a serious security risk to affected WordPress installations using the vulnerable Workreap plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and consider disabling or removing the Workreap plugin if possible. Monitor for updates from AmentoTech regarding patches or official mitigations.