CVE-2026-74928 in Project Manager Plugin
Summary
by MITRE • 08/26/2026
The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability in the Project Manager WordPress plugin prior to version 4.0.7 represents a critical authentication bypass that fundamentally undermines the security model of any website running this software. The core issue lies within the plugin’s import functionality, specifically regarding how it handles user account creation during data imports. In a standard secure implementation, any action that modifies system state or creates new entities should require verification of the caller's identity and permissions. However, in these affected versions, the routes responsible for importing project-related data lack adequate authorization checks. This omission allows unauthenticated users to interact directly with the import endpoints without providing valid credentials or session tokens. By exploiting this gap, an attacker can execute requests that trigger the creation of new WordPress user accounts on the target site.
The technical mechanism behind this flaw involves the manipulation of input parameters sent to the import handler. Since there is no server-side validation confirming that the request originates from a logged-in administrator or a privileged user, the application blindly processes the incoming data. The attacker can supply specific fields within the import payload to define the username and password for a new account. Crucially, because the attacker controls these parameters, they are not restricted by the site’s native registration settings which typically require email verification, CAPTCHA challenges, or administrative approval for new user creation. This effectively neutralizes standard hardening measures designed to prevent unauthorized access through public-facing registration forms. The result is a direct path to account provisioning where the attacker selects both the identity and the authentication credentials of the new user.
From an operational impact perspective, this vulnerability poses severe risks to data integrity and system confidentiality. Once the malicious actor successfully creates an account with known credentials, they gain legitimate access to the WordPress dashboard or other areas protected by standard login mechanisms. If the created account is assigned a role with elevated privileges, such as Editor or Administrator, the attacker can modify site content, install additional plugins, alter themes, and potentially achieve full remote code execution through subsequent exploits targeting those higher-level capabilities. Even if only lower-privilege roles are available to be created by default, the presence of an unauthorized account provides a persistent foothold for further reconnaissance and lateral movement within the application environment. This type of vulnerability is particularly dangerous because it bypasses traditional perimeter defenses that rely on blocking unauthenticated access to sensitive endpoints.
This flaw aligns with CWE-287, which describes Improper Authentication, as well as CWE-613, Insufficient Session Expiration, insofar as the session established by the newly created account remains active and valid until explicitly terminated or expired according to standard WordPress policies. In terms of the MITRE ATT&CK framework for enterprise security, this behavior corresponds to Tactic TA0004 (Privilege Escalation) via Technique T1136 (Create Account), allowing adversaries to establish persistence without detection by typical intrusion prevention systems that monitor for brute-force or credential stuffing attacks. The attack vector is classified as Network-based and requires no user interaction, making it highly scalable and easily automatable using standard web request tools like curl or Python scripts with requests libraries.
Mitigation strategies must focus on immediate remediation of the codebase alongside broader security hygiene practices. The primary defense is to upgrade the Project Manager plugin to version 4.0.7 or later, where the developers have implemented proper authorization checks for all import-related routes. Until an update can be applied, administrators should consider disabling the specific import functionality if it is not actively required, thereby removing the attack surface entirely. Additionally, implementing a Web Application Firewall with rules that detect anomalous patterns in user creation requests can provide a layer of defense against exploitation attempts. It is also advisable to review existing user accounts for any suspicious entries created during periods when the vulnerability was active and potentially exploitable on production systems. Regular auditing of plugin code for missing access control checks remains essential, as similar flaws often exist across various WordPress extensions that handle data import or export features without rigorous validation of caller privileges.