CVE-2026-112822

WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability

AmentoTech Workreap Core

CVSS

8.5High

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in3.4.4Fixed versionCVE List

Published22 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

3.4.4Workreap CoreCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4.

Text from CVE List

Affected versions 1

Workreap Coreaffected: all versions before 3.4.4CVE List

References 1

patchstack.com/database/wordpress/plugin/workreap_core/vulnerability/wordpress-workreap-core-plugin-3-4-4-sql-injection-vulnerability?_s_id=cveReferencevia CVE List