The Workreap WordPress theme before 2.6.4 does not verify that an addon service belongs to the user issuing the request, or indeed that it is an addon service, when processing the workreap_addons_service_remove action, allowing any user to delete any post by knowing or guessing the id.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Workreap Theme | — | Update workreap theme to version 2.6.4, or a newer patched version | Dec 8, 2025 | Dec 2, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub