CVE-2026-112822

HighCVSS 8.5

Published: 22/10/2026(UTC)Updated: 22/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile - higher than 20% of all known CVEs

Summary

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection. This issue affects Workreap Core: from n/a before 3.4.4.

Risk Assessment

An attacker can exploit blind SQL injection to extract data from the database, which may lead to disclosure of sensitive information such as user data or passwords.

Recommendation

Update the Workreap Core plugin to version 3.4.4 or later that fixes the vulnerability. Until then, consider disabling the plugin or implementing WAF rules to block SQL injection attempts.

Other vulnerabilities in Workreap Core

CVE-2026-39759Critical
The vulnerability allows an employer or sales representative to perform arbitrary file upload in Workreap Core up to version 3.4.5.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS