Skip to content
Sign in
5.4 Medium

CVE-2026-74929 The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a…

Description

The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards.

Affected products and versions

Product Affected versions Fixed in
Project Manager 4.0 earliest → < 4.0.7 4.0.7

Other CVEs of Project Manager

The 3 CVEs of Project Manager →
CVE-2026-74930 The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the… 4.3 Medium CVE-2026-74928 The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes,… 7.5 High
Track this CVE