CVE-2026-74928 — WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes

CVE-2026-74928

WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes PUBLISHED

Description (CNA)

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting.

Affected (CNA)

Vendor / product	Versions
Unknown / Project Manager	affected 2.1.0 before 4.0.7

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/667093bc-e030-45ff-83e0-0d5a4f3abc16/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.