CVE-2026-74929: WP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR
The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Plugin - Project Managerto a version that resolves this vulnerability.Fixed in 4.0.7 - Configuration
Ensure the plugin properly authorizes each REST API request so subscribers cannot read other projects' task content/email addresses or modify other projects' task boards via IDOR.
WordPress Plugin - Project Manager REST API route access control = Restrict REST API routes to only projects the authenticated user belongs to (prevent cross-project access and task board modifications)
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user can exploit it, including users with the Subscriber role. The vulnerable REST API routes do not enforce whether the user belongs to the targeted project.
What information and actions are exposed?
An authenticated attacker can read task content and user email addresses from other projects. They can also modify task boards belonging to projects they are not assigned to.
Which plugin versions are affected?
WordPress Project Manager versions before 4.0.7 are affected.