Unauthorized Data Modification Vulnerability in WP Project Manager for WordPress

CVE-2024-10520

Summary

The WP Project Manager plugin for WordPress is impacted by a vulnerability that permits unauthorized users to manipulate project data. This arises from a missing capability check in the 'check' method used within the 'Create_Milestone', 'Create_Task_List', 'Create_Task', and 'Delete_Task' classes. As a result, unauthenticated attackers can create or delete milestones, task lists, and tasks across any projects, potentially leading to significant disruption and unauthorized alterations of project management resources. It's important to note that version 2.6.14 has only implemented a partial fix, highlighting the need for secure coding practices and prompt remediation.

References