WP Project Manager Pro CVE-2026-78470

Exploitation requires an authenticated WordPress session with at minimum Subscriber-level access - the lowest default WordPress role, obtainable via self-registration on sites with open user registration enabled. The plugin must be installed and active. The attacker requires only standard network access to the WordPress site (AV:N) with no special network positioning, man-in-the-middle capability, or local system access. No non-default configuration beyond plugin installation is specified. Exploitation is constrained to read-only database operations per the CVSS I:N metric - write, delete, or schema-modifying SQL operations are not indicated. Sites with user registration disabled (the WordPress default for many installations) or restricted to trusted users substantially reduce external attacker exposure, as obtaining the required Subscriber credential becomes a prerequisite that cannot be self-served.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 6.5, reflecting low-complexity network exploitation requiring Subscriber-level authentication, with high confidentiality impact but no integrity or availability consequences. The PR:L constraint is real but thin on sites with open user registration, where any external party can self-provision the necessary credentials at zero cost. EPSS data is absent from the provided intelligence, and no CISA KEV listing or POC exploit code has been identified, which moderates urgency slightly relative to the CVSS score alone. SSVC dimensions: exploitation status is none confirmed, the attack pattern is automatable given AV:N/AC:L/UI:N, and technical impact is partial (read-only). The realistic risk tier is moderate-to-high for publicly accessible WordPress installations with registration enabled, and low for closed or intranet deployments where Subscriber accounts cannot be self-provisioned by external attackers.

An attacker registers a free Subscriber account on a target WordPress site running the vulnerable plugin version, then submits HTTP requests to the affected plugin endpoint with SQL payloads embedded in the vulnerable parameter - for example, appending a UNION SELECT statement to extract rows from the wp_users table. The low complexity and absence of required user interaction suggest the attack can be scripted and repeated across multiple targets. No public POC has been identified, but the CWE-89 pattern is well-understood and commonly reproduced from published SQLi techniques.