Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Project Manager 4.0.7 Clear all filters
TI-2026-52633 CVE-2026-74930 · GHSA-q6jv-mwhq-fw2c

WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR

Priority LOW 20

The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a sub…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-08-26 Fixed in 4.0.7 CWE-639
TI-2026-52632 CVE-2026-74929 · GHSA-mcq5-vjfh-w694

WP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR

Priority LOW 24

The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task co…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0023 Published 2026-08-26 Fixed in 4.0.7 CWE-284
TI-2026-52631 CVE-2026-74928 · GHSA-p988-59fj-gg73

WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes

Priority LOW 39

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypass…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.004 Published 2026-08-26 Fixed in 4.0.7 CWE-862