PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-22728 AmentoTech CVE debrief

A SQL Injection vulnerability exists in the Workreap theme's plugin for WordPress, affecting versions from n/a through 3.3.6. This issue allows attackers to inject malicious SQL code, potentially leading to unauthorized access or data manipulation. Defenders should assess exposure, prioritize remediation, and verify inventory for affected systems. The vulnerability's impact includes potential unauthorized data access or manipulation, and defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Additionally, defenders should plan vendor-supported updates or mitigations through normal change control where exposure

Vendor
AmentoTech
Product
Workreap (theme's plugin)
CVSS
HIGH 8.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-08
Original CVE updated
2026-09-30
Advisory published
2026-01-08
Advisory updated
2026-09-30

Who should care

Defenders and security teams responsible for WordPress environments using the Workreap theme's plugin should assess exposure and prioritize remediation.

Why it matters

Defenders should assess exposure of Workreap theme's plugin in WordPress environments, prioritize remediation for affected systems, and verify inventory for Workreap theme's plugin version 3.3.6 or earlier due to potential SQL Injection vulnerability.

  • Potential for unauthorized data access or manipulation
  • Need for inventory verification and remediation prioritization
  • Potential disruption to WordPress environments

Technical summary

The Workreap theme's plugin for WordPress is vulnerable to SQL Injection, affecting versions from n/a through 3.3.6. This allows attackers to inject malicious SQL code, potentially leading to unauthorized access or data manipulation. The vulnerability arises from improper neutralization of special elements used in an SQL command. Defenders should assess exposure of Workreap theme's plugin in WordPress environments, prioritize remediation for affected systems, and verify inventory for Workreap theme's plugin version 3.3.6 or earlier. Review compensating controls

Defensive priority

High priority for remediation due to potential for unauthorized data access or manipulation.

Recommended defensive actions

  • Assess exposure of Workreap theme's plugin in WordPress environments
  • Prioritize remediation for affected systems
  • Verify inventory for Workreap theme's plugin version 3.3.6 or earlier

Evidence notes

The CVE record and NVD entry provide details on the SQL Injection vulnerability in Workreap theme's plugin. However, specific details on exploitation or affected systems are limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-22728 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-22728

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-22728 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-22728

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.