CVE-2024-10520: WP Project Manager <= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion
The WP Project Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'check' method of the 'CreateMilestone', 'CreateTaskList', 'CreateTask', and 'DeleteTask' classes in version 2.6.14. This makes it possible for unauthenticated attackers to create milestones, create task lists, create tasks, or delete tasks in any project. NOTE: Version 2.6.14 implemented a partial fix for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10520?
CVE-2024-10520 is classified as a high severity vulnerability due to unauthorized modification of data.
How do I fix CVE-2024-10520?
To fix CVE-2024-10520, update the WP Project Manager plugin to version 2.6.15 or later.
What versions are affected by CVE-2024-10520?
CVE-2024-10520 affects WP Project Manager plugin versions up to and including 2.6.14.
What kind of attack does CVE-2024-10520 enable?
CVE-2024-10520 enables unauthorized users to modify data through missing capability checks.
Who is the vendor for CVE-2024-10520?
The vendor for CVE-2024-10520 is WeDevs, the creator of the WP Project Manager plugin.