EUVD-2026-66279
GHSA-mcq5-vjfh-w694
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
REST API is network-accessible; any authenticated subscriber suffices (PR:L); no scope change; no availability impact; limited confidentiality and integrity loss confined to plugin data.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards.
AnalysisAI
Improper access control in the Project Manager WordPress plugin before 4.0.7 exposes several REST API routes without project-membership enforcement, allowing any low-privilege authenticated user - including subscribers - to read task content and user email addresses across projects they do not belong to, and to modify task boards of arbitrary projects. The flaw is a classic CWE-284 (Improper Access Control) exploitable with no special configuration, network-accessible, and requiring only a valid WordPress account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated WordPress session at subscriber level or above (CVSS PR:L confirmed); unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 (Medium) vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N is a reasonable characterization: network-accessible, low complexity, but gated behind the PR:L (low-privilege authentication) requirement, which is a meaningful barrier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A publicly available exploit exists, reported by WPScan. An attacker who registers or already holds a WordPress subscriber account on a target site running Project Manager prior to 4.0.7 crafts GET and PATCH REST API requests against project and task endpoints - using their authenticated session cookie - targeting project IDs they are not authorized for. … |
| Remediation | Update the Project Manager WordPress plugin to version 4.0.7 or later, which is the vendor-released patch that introduces proper project-membership checks on the affected REST API routes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Project Manager
View allUnauthenticated account creation in the Project Manager WordPress plugin before version 4.0.7 allows any remote attacker
Broken object-level authorization in the Project Manager WordPress plugin before 4.0.7 allows any authenticated user - i
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today