WordPress Plugin Vulnerabilities

WP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR

Description

The plugin does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards.

Proof of Concept

Affects Plugins

Plugin icon
wedevs-project-manager
Fixed in 4.0.7

References

CVE
CVE-2026-74929

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Pedro Pinho
Submitter
Pedro Pinho
Verified
Yes
WPVDB ID
6c8a1143-2f91-4977-a2bb-e3d3ca3a64f0

Timeline

Publicly Published
2026-08-24 (about 3 days ago)
Added
2026-08-24 (about 2 days ago)
Last Updated
2026-08-24 (about 2 days ago)

Other

Published
Title
Published
2021-04-22
Title
Multiple WP-Buy Plugins - Arbitrary Plugin Installation/Activation via Low Privilege User
Published
2026-07-20
Title
Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation
Published
2026-07-27
Title
The GDPR Framework < 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Requests Spam
Published
2024-03-04
Title
Password Protected Store for WooCommerce < 2.3 - Unauthenticated Arbitrary Post Tile & Content Access
Published
2024-02-16
Title
My Private Site < 3.1.0 - Improper Access Control to Sensitive Information Exposure via REST API