CVE-2021-24499

What it actually does

The Workreap WordPress theme exposed unauthenticated AJAX upload actions, workreap_award_temp_file_uploader and workreap_temp_file_uploader, without nonce validation, authentication checks, file type enforcement, or filename/content sanitization. A remote attacker can send a crafted request to WordPress admin-ajax.php and place arbitrary files under the uploads/workreap-temp directory. Because PHP files may be executable in typical WordPress hosting configurations, this can lead to unauthenticated remote code execution, web shell deployment, data theft, site defacement, privilege escalation within WordPress, or full compromise of the underlying hosting account.

Why it matters to the business

A vulnerable public WordPress site can be taken over without valid credentials. Successful exploitation may allow attackers to modify website content, steal user or customer data, distribute malware, send spam, create backdoor administrator access, or use the server as a foothold for broader attacks. The CVSS score is critical, EPSS is high at approximately 60%, and exploit maturity is weaponized, so exposed sites should be treated as high-priority even though this issue is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies a WordPress site using a vulnerable version of the Workreap theme. They then send an unauthenticated POST request to /wp-admin/admin-ajax.php using one of the vulnerable AJAX actions, such as workreap_temp_file_uploader or workreap_award_temp_file_uploader, and include a malicious PHP payload disguised as an uploaded file. Because the theme does not validate the requester or restrict executable file types, the file can be written to /wp-content/uploads/workreap-temp/. The attacker then browses directly to the uploaded PHP file to execute commands on the server. From there, they may install a persistent web shell, add WordPress administrator users, modify theme or plugin files, dump configuration secrets, access the WordPress database, or pivot into the hosting environment.

How to fix it

Upgrade the Workreap theme to version 2.2.2 or later. If an upgrade is not immediately possible, disable or remove the Workreap theme until it can be patched. As a compensating control, block unauthenticated access to the vulnerable AJAX actions at the WAF or web server layer, specifically requests to /wp-admin/admin-ajax.php containing action=workreap_temp_file_uploader or action=workreap_award_temp_file_uploader. Configure the web server to prevent PHP execution in WordPress upload directories, especially /wp-content/uploads/ and /wp-content/uploads/workreap-temp/. Review file permissions so the web server cannot write executable code where it can later be executed. After patching, remove suspicious files from the temporary upload directory and rotate credentials if compromise is suspected, including WordPress administrator passwords, database credentials, hosting control panel credentials, and API keys stored on the server.

How to confirm the fix worked

Confirm the installed Workreap theme version is 2.2.2 or later by checking the WordPress admin theme details, the theme changelog, or the theme stylesheet metadata. Verify that unauthenticated requests to /wp-admin/admin-ajax.php using action=workreap_temp_file_uploader and action=workreap_award_temp_file_uploader are rejected and do not create files. Confirm that PHP execution is disabled under /wp-content/uploads/ by placing a benign test file in a controlled manner or reviewing web server configuration for deny rules. Inspect /wp-content/uploads/workreap-temp/ for executable files, recently modified files, unknown archives, and suspicious filenames. Review web server access logs for prior POST requests to admin-ajax.php using the vulnerable action names and subsequent GET requests to files in the workreap-temp directory.

Typical attack path

1. Scan for WordPress sites using the Workreap theme or exposed Workreap-specific assets.
2. Send an unauthenticated multipart/form-data POST request to /wp-admin/admin-ajax.php with action=workreap_temp_file_uploader or action=workreap_award_temp_file_uploader.
3. Upload a PHP web shell or other executable payload into /wp-content/uploads/workreap-temp/.
4. Request the uploaded file directly from the web to execute server-side code.
5. Run reconnaissance commands, read wp-config.php, enumerate users, and inspect installed plugins and themes.
6. Create persistence by adding backdoor files, modifying theme/plugin code, or creating unauthorized WordPress administrator accounts.
7. Use the compromised site for data theft, defacement, spam, malware hosting, credential theft, or further lateral movement depending on hosting access.

How to detect it

Review HTTP access logs, WAF logs, CDN logs, endpoint telemetry, and file integrity monitoring for signs of unauthenticated uploads and follow-on web shell access. Key evidence includes POST requests to /wp-admin/admin-ajax.php containing action=workreap_temp_file_uploader or action=workreap_award_temp_file_uploader, especially with multipart/form-data content, followed by GET or POST requests to files under /wp-content/uploads/workreap-temp/. On the host, inspect file creation and modification events in /wp-content/uploads/workreap-temp/ and other upload directories, focusing on .php, .phtml, .phar, .php5, .shtml, and suspicious image-extension polyglot files. Check for common web shell behavior such as requests containing cmd=, shell=, exec=, system=, passthru=, base64-encoded payloads, or unusual POST bodies to newly uploaded files. Review WordPress audit logs for unauthorized administrator creation, plugin or theme editor changes, unexpected plugin installation, and option changes after suspicious upload activity. If endpoint logging is available, correlate web server child processes spawning shell utilities such as sh, bash, dash, curl, wget, perl, python, php, nc, or chmod.

• action=workreap_temp_file_uploader
• action=workreap_award_temp_file_uploader
• /wp-admin/admin-ajax.php
• /wp-content/uploads/workreap-temp/
• /wp-content/uploads/workreap-temp/*.php
• /wp-content/uploads/workreap-temp/*.phtml
• /wp-content/uploads/workreap-temp/*.phar
• POST /wp-admin/admin-ajax.php
• multipart/form-data
• GET /wp-content/uploads/workreap-temp/
• cmd=
• exec=
• shell=
• passthru=
• system=
• base64_decode(
• eval(
• assert(
• FilesMatch ".*\.php"
• php_flag engine off

What your security team should do

• Immediately identify internet-facing WordPress sites using the Workreap theme and prioritize them for upgrade to version 2.2.2 or later.
• Search web access logs for exploitation attempts using the two vulnerable AJAX action names and investigate any successful file uploads.
• Inspect /wp-content/uploads/workreap-temp/ and the broader uploads directory for PHP, phtml, phar, or other executable files and remove anything unauthorized.
• Disable PHP execution in WordPress upload directories across all WordPress deployments as a hardening baseline.
• If evidence of exploitation is found, perform incident response: preserve logs and suspicious files, identify commands executed through any web shell, review WordPress admin users, rotate credentials, and restore from a known-good backup if integrity cannot be trusted.
• Deploy WAF or reverse-proxy rules blocking requests to /wp-admin/admin-ajax.php that contain action=workreap_temp_file_uploader or action=workreap_award_temp_file_uploader from unauthenticated sources.
• Monitor for recurrence by alerting on executable file creation under WordPress upload paths and direct web requests to PHP files inside upload directories.