Project Manager WordPress Plugin Vulnerability Exposes User Data and Task Boards
CVE-2026-74929
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 26 August 2026
Badges
What is CVE-2026-74929?
The Project Manager plugin for WordPress, prior to version 4.0.7, features a significant vulnerability that fails to enforce proper access controls on multiple REST API routes. This oversight allows authenticated users, including those with limited permissions, to gain unauthorized access to sensitive project data. Users can read contents of tasks from other projects and view sensitive information such as email addresses. Additionally, they can modify task boards belonging to projects they should not have access to, posing a risk of unauthorized alterations and data leaks. Users of this plugin are advised to update to the latest version to mitigate these security risks.
Affected Version(s)
Project Manager 0 < 4.0.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.