98 matches found
WordPress Project Manager plugin 2.1.0-4.0.6 - Unauthenticated Subscriber Account Creation vulnerability
Unauthenticated Subscriber Account Creation vulnerability discovered by Usama Arshad in WordPress Plugin WP Project Manager versions 2.1.0-4.0.6...
CVE-2026-74930 WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR
The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email...
WordPress Project Manager plugin < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification vulnerability
Subscriber+ Cross-Project Task Disclosure and Task Board Modification vulnerability discovered by Pedro Pinho in WordPress Plugin WP Project Manager versions 4.0.7...
CVE-2026-74928
The WP Project Manager WordPress plugin (versions 2.1.0–4.0.6 ) lacks an authorization check on its Trello import routes , allowing unauthenticated users to create WordPress accounts with a password the attacker already knows , effectively bypassing the site's registration setting. This was disco...
WordPress Project Manager plugin 2.2.0-4.0.7 - 4.0.6 - Subscriber+ User Activity Feed Disclosure vulnerability
WordPress Project Manager plugin 2.2.0-4.0.7 - 4.0.6 - Subscriber+ User Activity Feed Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin WP Project Manager versions 2.2.0-4.0.6...
CVE-2026-74928 WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes
The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting...
CVE-2026-74929 WP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR
The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards...
CVE-2026-74929
The WP Project Manager WordPress plugin (by WEDevs) prior to 4.0.7 suffers from an IDOR (Insecure Direct Object Reference) flaw in several of its REST API routes . Because these routes are not properly scoped to the projects a user belongs to, any authenticated user with at least Subscriber role ...
CVE-2026-74930
The WordPress Project Manager plugin (versions 2.2.0–4.0.6 ) contains an IDOR flaw in one of its REST API routes: it fails to verify that the user whose activity feed is being requested is the same user making the request. As a result, any authenticated user at subscriber level or above can read ...
CVE-2026-78470
The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...
CVE-2026-78470 WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection
The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...
EUVD-2026-65299
The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...
EUVD-2026-65169
Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...
PT-2026-81176
Name of the Vulnerable Software and Affected Versions WP Project Manager Pro versions prior to 4.0.2 Description Insufficient escaping of user-supplied parameters and lack of proper preparation in SQL queries allow authenticated attackers with Subscriber-level access and above to perform SQL...
CVE-2026-78262
Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...
CVE-2026-78262
WP Project Manager (WordPress plugin by WeDevs ) is affected by an unauthenticated PHP Object Injection vulnerability in versions ≤ 4.0.6 . The flaw allows a remote, unauthenticated attacker over the network with low complexity and no user interaction to achieve high impact on confidentiality, in...
CVE-2026-78262 WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...
WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by 20kilograma in WordPress Plugin WP Project Manager versions = 4.0.6...