Project Manager CVE-2026-74929

Exploitation requires a valid authenticated WordPress session at subscriber level or above (CVSS PR:L confirmed); unauthenticated exploitation is not possible. No special server configuration or non-default plugin settings are required - the vulnerable REST API routes are active in the default plugin installation. The primary limiting factor is the need for at least one valid WordPress account, making sites with open user registration or large untrusted user bases substantially more exposed. There is no user interaction requirement and no network-level restriction beyond standard HTTPS access to the WordPress site. The vulnerability is bounded: it does not enable code execution, privilege escalation to administrator, or denial of service - impact is confined to cross-project data read and task board write within the plugin's data scope.

The CVSS 5.4 (Medium) vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N is a reasonable characterization: network-accessible, low complexity, but gated behind the PR:L (low-privilege authentication) requirement, which is a meaningful barrier. Scope is unchanged (S:U) and there is no availability impact. EPSS at 0.16% (5th percentile) suggests this vulnerability is not seeing broad exploitation despite a publicly available PoC reported by WPScan, which is consistent with the PR:L constraint limiting opportunistic mass exploitation. KEV listing is not confirmed, so active targeted exploitation cannot be asserted. The real-world risk is highest on WordPress sites with open user registration or with multiple untrusted authenticated users: subscriber accounts are trivial to obtain in those environments, and harvested user email addresses create a downstream phishing pivot risk. Integrity impact (task board modification) could disrupt project workflows or enable social engineering via planted task content. The absence of A:N (no availability impact) and the confined scope keep this from critical classification, but the combination of public PoC and low exploitation barrier warrants prompt patching in any multi-user WordPress deployment.

A publicly available exploit exists, reported by WPScan. An attacker who registers or already holds a WordPress subscriber account on a target site running Project Manager prior to 4.0.7 crafts GET and PATCH REST API requests against project and task endpoints - using their authenticated session cookie - targeting project IDs they are not authorized for. The attacker enumerates task details and harvests user email addresses from all projects on the site, then modifies task boards of those projects to corrupt data or plant misleading content, all without triggering any project-level authorization check.