CVE-2024-10548: WP Project Manager <= 2.6.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API
The WP Project Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.15 via the Project Task List ('/wp-json/pm/v2/projects/1/task-lists') REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including the hashed passwords of project owners (e.g. adminstrators).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10548?
CVE-2024-10548 has a moderate severity rating due to the potential for sensitive information exposure.
How do I fix CVE-2024-10548?
To fix CVE-2024-10548, update the WP Project Manager plugin to version 2.6.16 or later.
Who is affected by CVE-2024-10548?
All users of the WP Project Manager plugin for WordPress up to and including version 2.6.15 are affected by CVE-2024-10548.
What type of attack can be executed due to CVE-2024-10548?
CVE-2024-10548 allows authenticated attackers to expose sensitive information through the project's task list API.
Is there a patch available for CVE-2024-10548?
Yes, a patch is available in version 2.6.16 of the WP Project Manager plugin to address CVE-2024-10548.