You need to grant permissions to WebWork:
grant { permission java.security.AllPermission; };
or more specifically,
grant { permission java.util.PropertyPermission "*", "read, write"; permission java.lang.reflect.ReflectPermission "suppressAccessChecks"; permission ognl.OgnlInvokePermission "*"; };