SQL Injection Vulnerability in WP Project Manager Plugin for WordPress
CVE-2024-13500
6.5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 15 February 2025
What is CVE-2024-13500?
The WP Project Manager plugin, used for task and team management in WordPress, is vulnerable to time-based SQL Injection through the 'orderby' parameter. This vulnerability arises due to inadequate escaping of user-supplied data and insufficient preparation of the existing SQL query. As a result, authenticated attackers with Subscriber-level access and higher can inject additional SQL queries into existing ones, enabling them to extract sensitive information from the database. It is critical for users of this plugin to update to the latest version to mitigate potential risks.
Affected Version(s)
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts * <= 2.6.17