WP Project Manager EUVD-2026-90839

Requires an authenticated low-privilege account at WordPress subscriber level (PR:L) on a site running WP Project Manager <= 4.0.7; exploitation is practical primarily where open/self-service user registration is enabled so an attacker can obtain such an account. No user interaction (UI:N) and no non-default configuration beyond having the plugin active are needed. The limiting factor is the authentication requirement - this is not reachable by fully unauthenticated attackers.

This is a moderate-risk, authenticated authorization flaw rather than a critical exposure. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L = 6.3 MEDIUM) shows network reach and low attack complexity, but PR:L confirms the attacker must already hold a valid low-privilege account (subscriber level, per the description) on the target WordPress site. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active exploitation or commodity tooling. The three Low impacts (C:L/I:L/A:L) indicate broad but limited effect - a subscriber can perform actions beyond their role, but there is no full compromise. Net: a real patch-management item for sites running this plugin with open/self-registration, but not an emergency. Note the 'Authentication Bypass' tag conflicts with CWE-862 (Missing Authorization): this is a post-authentication access-control defect, NOT an authentication bypass - verify before treating it as a pre-auth issue.

An attacker registers or obtains a low-privilege subscriber account on a WordPress site running WP Project Manager <= 4.0.7 (trivial where open registration is enabled). They then invoke project-manager actions or endpoints that lack a server-side capability check, letting them read, modify, or disrupt project/task data they should not be able to touch. No public exploit code was identified at time of analysis, and no user interaction is required.