CVE-2024-10174: WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.13 - Insecure Direct Object Reference to Unauthenticated Authorization Bypass
First published: Wed Nov 13 2024(Updated: )
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.13 via the 'Abstract_Permission' class due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to spoof their identity to that of an administrator and access all of the plugins REST routes.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WP Project Manager by WeDevs | <2.6.14 | |
| WP Project Manager | <=2.6.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/dea2d045-d3b4-4b55-8b4f-5baa82a18834?source=cve
- https://plugins.trac.wordpress.org/browser/wedevs-project-manager/trunk/core/Permissions/Abstract_Permission.php#L32
- https://plugins.trac.wordpress.org/changeset/3185807/wedevs-project-manager/trunk/core/Permissions/Abstract_Permission.php
Frequently Asked Questions
What is the severity of CVE-2024-10174?
CVE-2024-10174 has a severity rating that indicates a risk due to insecure direct object reference vulnerabilities in the WP Project Manager plugin.
How do I fix CVE-2024-10174?
To fix CVE-2024-10174, update the WP Project Manager plugin to version 2.6.14 or later where the vulnerability is addressed.
What versions are affected by CVE-2024-10174?
CVE-2024-10174 affects all versions of the WP Project Manager plugin up to and including version 2.6.13.
What type of vulnerability is CVE-2024-10174?
CVE-2024-10174 is classified as an Insecure Direct Object Reference (IDOR) vulnerability.
Who is the vendor of the software vulnerable to CVE-2024-10174?
The vendor of the vulnerable software for CVE-2024-10174 is WP Project Manager.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/source
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup-request
- vendor/wedevs
- canonical/wp project manager by wedevs
- vendor/wp project manager
- canonical/wp project manager