CVE-2022-4239

PoC —

CVSS 3.1

6.5 medium

EPSS

<1%p47

Published

Dec 26, 2022 (Dec 26, 2022)

Modified

Jun 17, 2026

Description

The Workreap WordPress theme before 2.6.4 does not verify that an addon service belongs to the user issuing the request, or indeed that it is an addon service, when processing the workreap_addons_service_remove action, allowing any user to delete any post by knowing or guessing the id.

Vendors: amentotech
Products: workreap
Ecosystems: WordPress
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.