Is there any formal support for WeBWorK? Someone we can submit an email to with this question?
It would be great for the creators/maintainers of WeBWorK to make some sort of statement, even if it's just 'we are still trying to determine if WeBWorK is vulnerable'.
WeBWorK does not directly use LDAP or JNDI, and so technically speaking WeBWorK is not affected by this vulnerability.
The question is if your apache server installation is vulnerable. If your server is using Ubuntu check to see if you have the package liblog4j2-java installed. If not, then you have nothing to worry about. You shouldn't have that unless you are using it for something. WeBWorK doesn't use it or need it. If you have it installed, then remove it if you don't need it. If you need it, then see if you can upgrade to version 2.15.0 (which fixes the vulnerability). Ubuntu's repositories contain version 2.11.2, but you should be able to find newer version in a PPA or something.
Note that even if you have the package installed, your server is not vulnerable unless you also have the module enabled for apache2.