CVE-2025-69101
Published: 22 January 2026
Description
Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Workreap Core workreap_core allows Authentication Abuse.This issue affects Workreap Core: from n/a through <= 3.4.1.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the authentication bypass vulnerability by requiring timely identification, reporting, and correction of flaws in the Workreap Core plugin.
Enforces approved authorizations for logical access, preventing exploitation of alternate paths or channels that bypass authentication in the plugin.
Provides robust identification and authentication for non-organizational users, countering authentication abuse and account takeover in the Workreap Core WordPress plugin.
Security SummaryAI
CVE-2025-69101 is an Authentication Bypass Using an Alternate Path or Channel vulnerability (CWE-288) in AmentoTech's Workreap Core WordPress plugin (workreap_core). This flaw enables authentication abuse and affects all versions from n/a through 3.4.1. The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with high impacts on confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows authentication abuse, leading to account takeover as detailed in the associated advisory.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/workreap_core/vulnerability/wordpress-workreap-core-plugin-3-4-0-account-takeover-vulnerability?_s_id=cve provides further details on this account takeover vulnerability in Workreap Core.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an authentication bypass in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications for account takeover.