{"id":"CVE-2026-112822","kind":"vulnerability","aliases":["CVE-2026-112822"],"related":[],"title":"Workreap Core WordPress plugin: blind SQL injection exposes database contents","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4.","summary":"Workreap Core, a WordPress plugin from AmentoTech, fails to neutralize special characters in an SQL query, so input reaches the database unescaped. An attacker can read data from the site's database one inference step at a time, which can include user records and password hashes.","severity":"high","cvss":8.5,"epss":0.00289,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["marketplace-sites","package","wordpress","workreap-core"],"not_affected_if":["plugin-not-installed","version-3.4.4-or-later"],"how_to_check":"- Check the installed Workreap Core plugin version in the WordPress admin plugins list or `wp plugin get workreap_core --field=version`\n- unknown whether other check paths are needed","fix":"- Update Workreap Core to `3.4.4` or later\n- unknown whether a workaround exists before updating","status":"open","published_at":"2026-10-22T11:17:32+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:00:20+00:00","updated_at":"2026-10-25T03:00:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:00:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update Workreap Core to `3.4.4` or later\n- unknown whether a workaround exists before updating","reach":"internet","title":"Workreap Core WordPress plugin: blind SQL injection exposes database contents","impact":"medium","summary":"Workreap Core, a WordPress plugin from AmentoTech, fails to neutralize special characters in an SQL query, so input reaches the database unescaped. An attacker can read data from the site's database one inference step at a time, which can include user records and password hashes.","category":"package","nicknames":[],"who_cares":["wordpress","workreap-core","marketplace-sites"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads database contents, including user credentials, via blind injection","analyst_note":"Confirm which Workreap Core endpoint is injectable and whether it requires login; check the NVD entry and the AmentoTech advisory for details.","how_to_check":"- Check the installed Workreap Core plugin version in the WordPress admin plugins list or `wp plugin get workreap_core --field=version`\n- unknown whether other check paths are needed","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-3.4.4-or-later"],"who_is_affected":"Sites running the Workreap Core plugin for WordPress before version 3.4.4, typically freelance or job marketplace sites built on Workreap. Sites without this plugin installed are not affected. The sources do not say which endpoints or settings make the injection reachable, so whether an unauthenticated visitor can trigger it is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000627,"input_tokens":3353,"output_tokens":583,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112822':13A,16A '-2026':12A,15A '3.4.4':101C 'affect':95C 'allow':90C 'amentotech':31B,85C 'attack':48B 'blind':5A,91C 'charact':36B 'command':80C 'content':10A 'core':2A,24B,26B,87C,89C,97C 'cve':11A,14A 'data':51B 'databas':9A,45B,56B 'element':75C 'expos':8A 'fail':32B 'hash':70B 'improp':71C 'includ':65B 'infer':58B 'inject':7A,82C 'injection.this':93C 'input':42B 'issu':94C 'marketplac':18B 'marketplace-sit':17B 'n/a':99C 'neutral':34B,72C 'one':57B 'packag':20B 'password':69B 'plugin':4A,29B 'queri':40B 'reach':43B 'read':50B 'record':67B 'site':19B,54B 'special':35B,74C 'sql':6A,39B,79C,81C,92C 'step':59B 'time':62B 'unescap':46B 'use':76C 'user':66B 'vulner':83C 'wordpress':3A,21B,28B 'workreap':1A,23B,25B,86C,88C,96C 'workreap-cor':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Workreap Core plugin for WordPress before version 3.4.4, typically freelance or job marketplace sites built on Workreap. Sites without this plugin installed are not affected. The sources do not say which endpoints or settings make the injection reachable, so whether an unauthenticated visitor can trigger it is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112822","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112822","severity":null,"published_at":"2026-10-22T11:17:32+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112822","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112822","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}