Live › vulnerability › CVE-2026-112822
Go to dashboardWorkreap Core, a WordPress plugin from AmentoTech, fails to neutralize special characters in an SQL query, so input reaches the database unescaped. An attacker can read data from the site's database one inference step at a time, which can include user records and password hashes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Workreap Core plugin for WordPress before version 3.4.4, typically freelance or job marketplace sites built on Workreap. Sites without this plugin installed are not affected. The sources do not say which endpoints or settings make the injection reachable, so whether an unauthenticated visitor can trigger it is unknown.
No product ranges from the sources yet.
wp plugin get workreap_core --field=version3.4.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-112822")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.