explains the shellshock bug pretty plainly. It seems the shellshock bug allows commands to be passed when environment variables are set in bash.
Personally, I know neither how much WeBWorK uses bash to set environment variables, nor how the shellshock bug is fixed. My guess is that the WeBWorK code never passes a command when environment variables are set in bash, and that the shellshock bug fix will not cause any problems. But, that is just a guess based on speculation, not examining the code (so it may be incorrect). I hope this helps.