Project Manager CVE-2026-74928

No special conditions are required - the vulnerable import routes are reachable by any unauthenticated remote attacker against default configurations of the Project Manager WordPress plugin on any WordPress installation running versions 2.1.0 through 4.0.6. The site's own WordPress registration setting (open or closed) does not limit exploitation, because the plugin pathway bypasses that control entirely. The only inherent limit on impact is the privilege level of the newly created account: if WordPress assigns newly created accounts a low-privilege role (e.g., Subscriber), further privilege escalation would require a separate vulnerability or misconfiguration. No specific non-default configuration, specific PHP version, or hosting environment is identified as a prerequisite.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N accurately reflects the core risk: this is a zero-friction, network-accessible flaw requiring no credentials, no user interaction, and no special configuration. A publicly available exploit further lowers the bar for opportunistic attackers. That said, EPSS at 0.18% (7th percentile) indicates that, despite the POC, mass exploitation has not yet materialized - the vulnerability may not yet be integrated into commodity WordPress attack toolkits. The CVE is not listed in the CISA KEV, so active exploitation is not confirmed. The practical risk scales with what a new WordPress account enables: on a site where contributor or subscriber roles carry minimal privileges, the immediate damage is limited to account creation noise; on a site where newly created accounts can post content, access project data managed by the plugin, or be escalated through secondary vulnerabilities, the risk is considerably higher. Even a modest-sized deployment running an unpatched version should treat remediation as urgent given the trivially exploitable nature of the flaw and the existence of public exploit code.

An attacker sends a crafted unauthenticated HTTP request to the Project Manager plugin's import route, supplying a desired username, email, and a password they have already chosen. The plugin creates a valid WordPress account without checking whether site registration is enabled or whether the requester holds any privilege. The attacker then logs in with those credentials, gaining a foothold on the WordPress site. A publicly available proof-of-concept demonstrates this flow.