CVE-2021-24501: Amentotech Workreap

High severity, CVSS 8.1. EPSS: 1.3% chance of exploitation in the next 30 days.

The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a logged in user to modify or delete objects belonging to other users on the site.

Affected products

• Amentotech Workreap: before 2.2.2 (fixed in 2.2.2)

Published 2021-08-09. Last modified 2026-06-17.