CVE-2026-97281

Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...

CVE-2026-97281 WordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerability

Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...

CVE-2026-97281

The WP Project Manager plugin for WordPress (versions

EUVD-2026-90839

Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...

WordPress Project Manager plugin 2.1.0-4.0.6 - Unauthenticated Subscriber Account Creation vulnerability

Unauthenticated Subscriber Account Creation vulnerability discovered by Usama Arshad in WordPress Plugin WP Project Manager versions 2.1.0-4.0.6...

CVE-2026-74929 WP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR

The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards...

CVE-2026-74930 WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR

The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email...

CVE-2026-74930 WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR

The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email...

CVE-2026-74928 WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting...

CVE-2026-74928 WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting...

WordPress Project Manager plugin < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification vulnerability

Subscriber+ Cross-Project Task Disclosure and Task Board Modification vulnerability discovered by Pedro Pinho in WordPress Plugin WP Project Manager versions 4.0.7...

CVE-2026-74928

The Project Manager WordPress plugin (versions 2.1.0-4.0.6 ) contains an authentication bypass vulnerability due to a lack of authorization checks on its import routes , specifically identified in the context of Trello import routes . This flaw allows unauthenticated users to create WordPress acc...

WordPress Project Manager plugin 2.2.0-4.0.7 - 4.0.6 - Subscriber+ User Activity Feed Disclosure vulnerability

WordPress Project Manager plugin 2.2.0-4.0.7 - 4.0.6 - Subscriber+ User Activity Feed Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin WP Project Manager versions 2.2.0-4.0.6...

CVE-2026-74929

The Project Manager WordPress plugin, in versions before 4.0.7 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to restrict several REST API routes to the specific projects a user is authorized to access. This oversight allows any authenticated user, suc...

CVE-2026-74929 WP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR

The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards...

CVE-2026-74930

The Project Manager WordPress plugin, versions 2.2.0 through 4.0.6 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify that the user requesting activity through a specific REST API route is the owner of that activity. This allows any authenticated user, ...

CVE-2026-78470

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

CVE-2026-78470 WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

CVE-2026-78470 WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

EUVD-2026-65299

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...