CVE-2025-68040: WordPress WP Project Manager plugin <= 3.0.1 - Sensitive Data Exposure vulnerability
Published Dec 29, 2025
·Updated
Insertion of Sensitive Information Into Sent Data vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 3.0.1.
Affected Software
1 affected component
weDevs WP Project Manager<=3.0.1
Event History
Dec 29, 2025
CVE Published
via MITRE·11:25 PM
Data Sourced
via MITRE·11:25 PM
DescriptionWeakness
Dec 30, 2025
Data Sourced
via NVD·12:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-68040?
CVE-2025-68040 is classified as a medium severity vulnerability.
2
How do I fix CVE-2025-68040?
To fix CVE-2025-68040, update your weDevs WP Project Manager to version 3.0.2 or later.
3
What kind of data is exposed in CVE-2025-68040?
CVE-2025-68040 exposes sensitive information that may be embedded in sent data.
4
Which versions of weDevs WP Project Manager are affected by CVE-2025-68040?
CVE-2025-68040 affects weDevs WP Project Manager versions up to and including 3.0.1.
5
Is there a known attack vector for CVE-2025-68040?
Yes, attackers can exploit this vulnerability to retrieve embedded sensitive data from the affected plugin.