EUVD-2026-66278
GHSA-p988-59fj-gg73
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable unauthenticated endpoint with no interaction needed; impact is integrity-only (unauthorized account creation), with no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting.
AnalysisAI
Unauthenticated account creation in the Project Manager WordPress plugin before version 4.0.7 allows any remote attacker to register WordPress user accounts regardless of the site's registration settings. The import routes in the plugin carry no authorization checks whatsoever (CWE-862), enabling an attacker who already knows the password they will submit to establish a persistent, valid WordPress account on the target site. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required - the vulnerable import routes are reachable by any unauthenticated remote attacker against default configurations of the Project Manager WordPress plugin on any WordPress installation running versions 2.1.0 through 4.0.6. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N accurately reflects the core risk: this is a zero-friction, network-accessible flaw requiring no credentials, no user interaction, and no special configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a crafted unauthenticated HTTP request to the Project Manager plugin's import route, supplying a desired username, email, and a password they have already chosen. The plugin creates a valid WordPress account without checking whether site registration is enabled or whether the requester holds any privilege. … |
| Remediation | Update the Project Manager WordPress plugin to version 4.0.7 or later, which is confirmed by the vendor advisory to contain the authorization fix; this is the only verified remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress instances running the Project Manager plugin and identify those running versions prior to 4.0.7. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Project Manager
View allImproper access control in the Project Manager WordPress plugin before 4.0.7 exposes several REST API routes without pro
Broken object-level authorization in the Project Manager WordPress plugin before 4.0.7 allows any authenticated user - i
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today