Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'workreap_temp_upload_to_media' function in all versions up to, and including, 3.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVE-2025-5012 is a critical vulnerability affecting the Workreap plugin for WordPress, specifically versions up to and including 3.3.2. Workreap is a plugin used in the Workreap - Freelance Marketplace WordPress Theme developed by AmentoTech. The vulnerability arises from improper validation of file types in the 'workreap_temp_upload_to_media' function, which handles temporary file uploads. This lack of validation allows authenticated users with as little as Subscriber-level privileges to upload arbitrary files to the server hosting the WordPress site. Because the plugin does not restrict the types of files that can be uploaded, attackers can potentially upload malicious scripts or executable files. This can lead to remote code execution (RCE), allowing attackers to execute arbitrary code on the server, compromise the underlying system, and potentially gain full control over the affected website and server environment. The vulnerability has a CVSS v3.1 base score of 8.8, indicating high severity, with attack vector being network-based, low attack complexity, requiring privileges (low), no user interaction, and impacting confidentiality, integrity, and availability at a high level. Although no known exploits are currently reported in the wild, the ease of exploitation combined with the potential impact makes this vulnerability a significant threat. The vulnerability affects all versions of the plugin up to 3.3.2, and no official patches or updates are currently linked, indicating that mitigation may require manual intervention or disabling the plugin until a fix is released. This vulnerability is categorized under CWE-434, which refers to unrestricted file upload vulnerabilities that can lead to code execution or other malicious activities.

Detailed information about CVE-2025-5012: CWE-434 Unrestricted Upload of File with Dangerous Type in AmentoTech Workreap affecting AmentoTech Workreap. Get real

Title	Severity	Type	Source	Date

Threats Tagged 'cve-2025-5012'

Filter Threats

Threats Tagged 'cve-2025-5012'