Skip to content
Sign in
7.5 High

CVE-2026-74928 The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes,…

Description

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting.

Affected products and versions

Product Affected versions Fixed in
Project Manager 2.1 2.1.0 → < 4.0.7 4.0.7

Other CVEs of Project Manager

The 3 CVEs of Project Manager →
CVE-2026-74930 The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the… 4.3 Medium CVE-2026-74929 The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a… 5.4 Medium
Track this CVE