CVE-2023-3636: WP Project Manager <= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation
The WP Project Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.6.4 due to insufficient restriction on the 'saveusersmapname' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'usernames' parameter.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-3636.
What is the severity of CVE-2023-3636?
The severity of CVE-2023-3636 is high with a severity score of 8.8.
Which software versions are affected by CVE-2023-3636?
Versions up to, and including, 2.6.4 of the WP Project Manager plugin for WordPress are affected by CVE-2023-3636.
How can an authenticated attacker exploit CVE-2023-3636?
An authenticated attacker, even with minimal permissions such as a subscriber, can exploit CVE-2023-3636 to perform privilege escalation and modify certain functions of the plugin.
Are there any references for CVE-2023-3636?
Yes, you can find references for CVE-2023-3636 at the following URLs: [link1](https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/2.6.3/src/User/Controllers/User_Controller.php#L158), [link2](https://plugins.trac.wordpress.org/changeset/2942291/wedevs-project-manager#file1792), [link3](https://www.wordfence.com/threat-intel/vulnerabilities/id/6a5e4708-db3e-483c-852f-1a487825cf92?source=cve)