CVE-2026-74930
Received Received - Intake

Unauthorized User Activity Access in Project Manager WordPress Plugin

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: WPScan

Description
The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email address and the details of projects they have no access to.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-74930
EUVD
EUVD-2026-66280

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
project_manager wordpress_plugin to 4.0.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the WP Project Manager WordPress plugin. It allows any authenticated user, including subscribers, to access another user's activity history, email address, and project details without proper authorization checks in a REST API route.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the WP Project Manager plugin versions 2.2.0 to 4.0.6. You can verify the plugin version in the WordPress admin panel under Plugins. Additionally, inspect REST API responses for user activity data to see if unauthorized users can access other users' details.

Impact Analysis

An attacker could exploit this to view sensitive information of other users, such as their email addresses and project details, even if they have no legitimate access. This could lead to privacy breaches or unauthorized data exposure.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without consent and HIPAA by leaking protected health information if project details include such data. It undermines data protection requirements for user privacy and access controls.

Mitigation Strategies

Immediately update the WP Project Manager plugin to version 4.0.7 or later. If updating is not possible, consider disabling the plugin until the update is applied. Review user permissions to ensure only authorized users can access sensitive data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74930. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart