Information Disclosure in Project Manager by WordPress
CVE-2026-74930
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 26 August 2026
Badges
What is CVE-2026-74930?
The Project Manager WordPress plugin prior to version 4.0.7 contains a security flaw in its REST API routes. This vulnerability enables any authenticated user, including those with minimal access rights like subscribers, to maliciously access activity records of other users. Consequently, sensitive information such as email addresses and project details are exposed, which should be kept confidential. Organizations using this plugin should promptly update to version 4.0.7 or later to safeguard against unauthorized data access.
Affected Version(s)
Project Manager 2.2.0 < 4.0.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.