CVE-2026-74928: WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes

Q: Are sites with WordPress user registration disabled still affected?

Yes. The vulnerable import routes can create WordPress accounts without authentication and bypass the site's own registration setting.

Q: What level of access does an attacker gain through this issue?

An attacker can create a WordPress account using a password they already know. The provided information does not specify the role or privileges assigned to the created account.

Q: Which plugin versions require remediation?

WordPress Project Manager versions 2.1.0 through 4.0.6 are affected. Version 4.0.7 is not described as affected.

Published Aug 26, 2026

Updated

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting.

Affected Software

1 affected component

WordPress Project Manager<4.0.7

Event History

Aug 26, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Are sites with WordPress user registration disabled still affected?

Yes. The vulnerable import routes can create WordPress accounts without authentication and bypass the site's own registration setting.

What level of access does an attacker gain through this issue?

An attacker can create a WordPress account using a password they already know. The provided information does not specify the role or privileges assigned to the created account.

Which plugin versions require remediation?