CVE-2026-74929

The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards.

Score

CVSS 3.1 5.4 Medium

Status

Deferred - contact@wpscan.com

Published

2026-08-26

Last modified

2026-08-26

Weaknesses

CWE-284

Affected products

• Project Manager (Unknown)

References

• https://wpscan.com/vulnerability/6c8a1143-2f91-4977-a2bb-e3d3ca3a64f0/