EUVD-2026-66280
GHSA-q6jv-mwhq-fw2c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible REST API requires only authenticated access (PR:L); no complexity or interaction needed; scope unchanged and impact limited to confidentiality of plugin-scoped data.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email address and the details of projects they have no access to.
AnalysisAI
Broken object-level authorization in the Project Manager WordPress plugin before 4.0.7 allows any authenticated user - including low-privilege subscribers - to read arbitrary users' activity histories, email addresses, and details of projects they have no legitimate access to via an unguarded REST API route. Affected versions span 2.2.0 through 4.0.6, with a patch released at 4.0.7. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires possession of a valid WordPress user account at any role level, including subscriber, on a site running Project Manager versions 2.2.0 through 4.0.6. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately characterizes the attack surface: network-accessible, low complexity, requiring only a valid authenticated account with no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or obtains a subscriber-level WordPress account on a site running Project Manager before 4.0.7. Using the publicly documented WPScan proof-of-concept, they craft REST API requests substituting other users' identifiers into the activity endpoint, iterating through user IDs to harvest email addresses and full project activity histories for all users in the system - without being a member of any of those projects. |
| Remediation | Update the Project Manager WordPress plugin to version 4.0.7 or later, which introduces the missing authorization check on the affected REST API route. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Project Manager
View allUnauthenticated account creation in the Project Manager WordPress plugin before version 4.0.7 allows any remote attacker
Improper access control in the Project Manager WordPress plugin before 4.0.7 exposes several REST API routes without pro
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today