Privilege Escalation Flaw in WP Project Manager Plugin by WordPress
CVE-2023-3636
8.8HIGH
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 31 August 2023
What is CVE-2023-3636?
The WP Project Manager plugin for WordPress contains a flaw that allows authenticated users with minimal permissions to escalate their privileges. This vulnerability arises from inadequate restrictions on the 'save_users_map_name' function, enabling attackers, such as subscribers, to alter their user roles through manipulation of the 'usernames' parameter. Users are encouraged to update to the latest version to mitigate this risk.
Affected Version(s)
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts * <= 2.6.4