Workreap Core: Arbitrary file upload by employer and sales representative accounts

Summary

Workreap Core, a WordPress plugin for freelance marketplace sites, up to and including version 3.4.5 allows an authenticated user with the employer or sales representative role to upload arbitrary files. An attacker with such an account could upload malicious files to the server, which may allow taking over the website. The attack requires a valid account with these roles; open registration would make this easier to reach.

Affected

• Workreap Core plugin (AmentoTech) up to and including 3.4.5
• Required privilege: Employer or Sales Representative account

Fixed in

Unknown. No patched version has been confirmed by the vendor or Patchstack at the time of writing.

Workaround

• Restrict or disable new employer and sales representative registrations until a fix is confirmed
• Remove role-based upload features where the business does not need them
• Use a web application firewall with virtual patching, if available
• Patchstack users may apply its mitigation rule; this is not confirmed by the vendor

Exploitation

• Not known exploited; not listed in CISA KEV at the time of writing
• No public proof of concept found
• NVD status: Deferred (analysis pending)

Our recommendation

• Identify all WordPress sites running Workreap Core 3.4.5 or older
• Apply the mitigations above now and restrict registration of employer and sales representative accounts
• Check the uploads directory and recent media for unexpected executable files
• Monitor the Patchstack entry and the vendor for a fixed release and update promptly once available
• Treat as high priority for sites with open marketplace registration

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack: Arbitrary File Upload in Workreap Core Plugin patchstack.com
• Strix: CVE-2026-39759 www.strix.ai
• HOL Guard: CVE-2026-39759 hol.org
• CVEBrief archive 2026-10-06 cvebrief.com
• OpenCVE: Workreap (amentotech) app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:40.