CVE-2022-4239: Workreap < 2.6.4 - Subscriber+ Arbitrary Posts Deletion via IDOR
The Workreap WordPress theme before 2.6.4 does not verify that an addon service belongs to the user issuing the request, or indeed that it is an addon service, when processing the workreapaddonsserviceremove action, allowing any user to delete any post by knowing or guessing the id.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-4239?
CVE-2022-4239 is considered to be a high severity vulnerability due to its potential to allow unauthorized users to delete posts.
How do I fix CVE-2022-4239?
To fix CVE-2022-4239, update the Workreap WordPress theme to version 2.6.4 or later, which includes a fix for this vulnerability.
Who is affected by CVE-2022-4239?
Users of the Workreap WordPress theme prior to version 2.6.4 are affected by CVE-2022-4239.
What type of vulnerability is CVE-2022-4239?
CVE-2022-4239 is an authorization bypass vulnerability that allows any user to remove an addon service or delete posts.
Can CVE-2022-4239 be exploited without authentication?
Yes, CVE-2022-4239 can be exploited by any user without proper authentication, merely by knowing or guessing the post identifier.