External risk intelligence

Workreap Core Arbitrary File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-39759

The vulnerability affects a WordPress plugin, which is typically deployed as part of a public-facing web application. WordPress plugins are commonly accessible via the internet to facilitate site functionality, making the vulnerable file upload interface reachable by external users.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been identified in Workreap Core software, a technology used in sales and employee management. This vulnerability could allow unauthorized individuals to upload malicious files, potentially leading to significant data compromise or system disruption. While the specific impact depends on how Workreap Core is integrated into your operations, the severity warrants attention to understand its potential relevance to your business.

Unrestricted file uploads create system risk.
Crucial for sales and HR systems to understand.
Verify if this specific software is in use.

Attack Path

How an attacker could exploit the issue

An attacker with low-privileged access could upload a malicious file to the Workreap Core plugin. This could allow them to execute code on the server, modify data, and disrupt services.

Requires authenticated access.
Triggered by uploading a crafted file.
Risk of code execution and data tampering.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an authenticated employer or sales representative to upload arbitrary files to the system. This could potentially lead to the execution of malicious code or the modification of system behavior when supported by the advisory.

Arbitrary files could be uploaded.
File upload functionality could be exploited.
System compromise or disruption may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical arbitrary file upload vulnerability in Workreap Core requires immediate attention from teams responsible for managing customer-facing applications. The first step is to identify all instances of the affected plugin, assess their exposure and business criticality, and pinpoint the accountable owner to develop a targeted remediation plan.

Application owners should manage remediation.
Verify plugin reachability and criticality.
Plan targeted updates and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Workreap Core plugin used for?

Workreap Core is a WordPress plugin designed to manage professional interactions, specifically facilitating employer and sales representative workflows. It serves as a backend component for web platforms that handle recruitment, job matching, or sales-related data management within the WordPress ecosystem.

What does arbitrary file upload mean for CVE-2026-39759?

This vulnerability is classified as CWE-434, which refers to Unrestricted Upload of File with Dangerous Type. It means the software does not properly validate the files users submit. An attacker can exploit this by uploading a malicious script instead of an expected file, which the server might then execute, potentially granting the attacker unauthorized control over the system.

How is this file upload vulnerability triggered?

The vulnerability is triggered when a user with authenticated access—such as an employer or sales representative account—submits a specially crafted file to the plugin. It is important to note that this is not a public, unauthenticated entry point; the attacker must already possess valid, albeit low-privileged, credentials to interact with the upload interface.

Is my site at risk from CVE-2026-39759?

Halo Surface Signal indicates this vulnerability is likely relevant to your site because the plugin operates within WordPress, a platform typically deployed to face the internet. Since the functionality intended for public-facing business operations is accessible to remote users, any instance of this plugin on a public web application is considered reachable.

What should I do if I run Workreap Core?

Begin by auditing your environment to confirm if the Workreap Core plugin is installed and active. Once identified, evaluate the plugin's role in your business processes and coordinate with the application owner to review available updates or temporary mitigation strategies. Prioritize this for any systems that interact with external users.

References

patchstack.com/database/wordpress/plugin/workreap_core/vulnerability…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.