CVE-2022-3846

Workreap - Freelance Marketplace and Directory < 2.6.3 - Subscriber+ Private Message Disclosure via IDOR

High · published December 5, 2022

CVSS v3.1
7.5
EPSS
1%
Percentile
57.4
In the wild
Unconfirmed
What it is

The Workreap WordPress theme before 2.6.3 has a vulnerability with the notifications feature as it's possible to read any user's notification (employer or freelancer) as the notification ID is brute-forceable.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00839 · 57.4th percentile
Published
2022-12-05T16:51Z
EPSS history
Timeline
  • 05 DEC 16:51Z
    Workreap - Freelance Marketplace and Directory < 2.6.3 - Subscriber+ Private Message Disclosure via IDOR
    cvelistv5