Sensitive Data Exposure Vulnerability in WP Project Manager Plugin for WordPress
CVE-2024-10548

6.5MEDIUM

Key Information:

Vendor
Wordpress
Status
WP Project Manager – Task, Team, And Project Management Plugin Featuring Kanban Board And Gantt Charts
Vendor
CVE Published:
19 December 2024

Summary

The WP Project Manager plugin for WordPress is critically vulnerable to sensitive information exposure due to a flaw in the REST API endpoint ('/wp-json/pm/v2/projects/1/task-lists'). This vulnerability affects all versions of the plugin up to and including 2.6.15. Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability to retrieve sensitive data, including hashed passwords of project administrators. Website owners using this plugin should urgently apply updates to prevent potential unauthorized access and safeguard sensitive information.

Affected Version(s)

WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts * <= 2.6.15

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3206717/wede...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Noah Stead
.