Sensitive Data Exposure Vulnerability in WP Project Manager Plugin for WordPress
CVE-2024-10548
6.5MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 19 December 2024
What is CVE-2024-10548?
The WP Project Manager plugin for WordPress is critically vulnerable to sensitive information exposure due to a flaw in the REST API endpoint ('/wp-json/pm/v2/projects/1/task-lists'). This vulnerability affects all versions of the plugin up to and including 2.6.15. Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability to retrieve sensitive data, including hashed passwords of project administrators. Website owners using this plugin should urgently apply updates to prevent potential unauthorized access and safeguard sensitive information.
Affected Version(s)
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts * <= 2.6.15