Project Manager CVE-2026-74930

Exploitation requires possession of a valid WordPress user account at any role level, including subscriber, on a site running Project Manager versions 2.2.0 through 4.0.6. No elevated privileges, special server configuration, or non-default plugin settings are required - the vulnerable REST API route is active in a standard plugin deployment. Exploitation is bounded by the authentication requirement: unauthenticated visitors cannot exploit this flaw, and the data accessible is limited to Project Manager's own data model (user activity, email addresses, project details). Access to the WordPress filesystem, database, or other plugins is not obtained through this vulnerability.

The CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately characterizes the attack surface: network-accessible, low complexity, requiring only a valid authenticated account with no user interaction. The confidentiality impact is limited to plugin-scoped data (user activity logs, email addresses, project details) - not full system compromise. EPSS at 0.16% (5th percentile) reflects minimal observed exploitation at scale, which is consistent with the absence of a CISA KEV listing. However, a publicly available WPScan proof-of-concept lowers the exploitation barrier significantly: any authenticated user on a vulnerable site can run this with minimal effort. The practical risk is highest on multi-tenant or public-registration WordPress sites where untrusted subscribers exist alongside sensitive project data - even a small business or internal team portal running this plugin with open registration should treat patching as a near-term priority. The CVSS and EPSS signals are not in conflict; the low EPSS reflects that mass exploitation has not materialized, likely because exploitation requires a valid account, which limits opportunistic scanning.

An attacker registers or obtains a subscriber-level WordPress account on a site running Project Manager before 4.0.7. Using the publicly documented WPScan proof-of-concept, they craft REST API requests substituting other users' identifiers into the activity endpoint, iterating through user IDs to harvest email addresses and full project activity histories for all users in the system - without being a member of any of those projects.