CVE-2026-74929 — WP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR

CVE-2026-74929

WP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR PUBLISHED

Description (CNA)

The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards.

Affected (CNA)

Vendor / product	Versions
Unknown / Project Manager	affected 0 before 4.0.7

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/6c8a1143-2f91-4977-a2bb-e3d3ca3a64f0/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.