CVE-2026-74930: WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR
The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email address and the details of projects they have no access to.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user can exploit it, including users with only the Subscriber role. The attacker does not need access to the projects or activity records they request.
What information can be exposed?
An attacker can read other users' activity histories, including email addresses and details of projects to which the attacker has no authorized access.
Which plugin versions are affected?
WP Project Manager versions before 4.0.7 are affected. The reported affected range includes versions 2.2.0 through 4.0.6.