Workreap Core CVE-2026-39759

Requires an authenticated account with the Workreap Employer or Sales Representative role (PR:L) and reachability of the plugin's file upload feature over the network. Exploitation does not require user interaction (UI:N) and is low complexity (AC:L). The practical limiting factor is account access: on sites that allow open self-registration of employer/vendor accounts the barrier is minimal, whereas sites restricting account creation or using additional upload validation/WAF controls raise the bar. Affected scope is Workreap Core plugin versions <= 3.4.5; sites on patched versions or not exposing the vulnerable upload path are not exploitable.

This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) describes a network-reachable, low-complexity arbitrary file upload (CWE-434) requiring only low-privilege authentication, with a changed scope and high confidentiality/integrity/availability impact - consistent with the 9.9 score and typical of webshell-to-RCE outcomes in WordPress plugins. The PR:L requirement is meaningful: exploitation needs a valid Employer or Sales Representative account, which on many Workreap-based freelance marketplaces is self-registerable, effectively lowering the barrier toward unauthenticated-equivalent in open-registration deployments - verify registration policy per site. Signals are otherwise thin: no EPSS probability, no CISA KEV listing, and no public exploit code were provided, so there is no evidence of active or widespread exploitation at this time. The only source is a Patchstack advisory. Net: treat as a real priority to patch quickly because of the low complexity, network vector, and RCE-grade impact, but current data indicates no confirmed in-the-wild exploitation - the urgency is driven by exploitability potential, not observed attacks.

An attacker registers or obtains a low-privilege Employer or Sales Representative account on a Workreap-powered marketplace, then abuses the plugin's file upload functionality to upload a malicious PHP file instead of a permitted document or image. Once the file lands in a web-accessible directory, the attacker requests it to execute arbitrary code on the server. No public proof-of-concept exploit was identified at time of analysis.