CVE-2026-74930 in Project Manager Plugin
Summary
by MITRE • 08/26/2026
The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email address and the details of projects they have no access to.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified within the Project Manager WordPress plugin prior to version 4.0.7 represents a critical failure in server-side access control logic, specifically manifesting as an Insecure Direct Object Reference or Broken Access Control issue. This flaw resides within one of the plugin's REST API endpoints responsible for retrieving user activity logs. The core technical deficiency is the absence of proper authorization checks to verify that the authenticated user initiating the request possesses administrative privileges or specific permissions required to view another user's data. Instead, the endpoint relies solely on the presence of a valid authentication cookie or token without validating whether the subject of the requested resource matches the identity of the requester. This architectural oversight allows any logged-in user with even the most minimal privilege level, such as a subscriber, to bypass intended security boundaries and access sensitive information belonging to other users within the WordPress environment.
From an operational perspective, this vulnerability enables unauthorized data exfiltration on a significant scale. An attacker exploiting this flaw can systematically iterate through user identifiers to harvest activity histories for all registered users on the site. The exposed data includes not only detailed logs of actions performed by each user but also their associated email addresses and specific details regarding projects they are assigned to, regardless of whether those project assignments grant them actual access rights. This leakage compromises both confidentiality and integrity principles. The exposure of email addresses facilitates targeted phishing campaigns or credential stuffing attacks against users who may have weak passwords across multiple services. Furthermore, the disclosure of project details for which a user has no legitimate access provides adversaries with valuable intelligence regarding organizational structure, ongoing initiatives, and potential high-value targets within the company's digital infrastructure.
This vulnerability aligns closely with Common Weakness Enumeration category CWE-284, which covers Improper Access Control, as well as CWE-601, known as URL Redirection to Untrusted Site or Open Redirect, in contexts where object identifiers are manipulated without validation. In terms of the MITRE ATT&CK framework for enterprise security, this behavior is characteristic of T1530, Data from Local System, and more specifically relates to data exfiltration techniques that leverage legitimate application functionality to access unauthorized resources. The ability to read activity logs also touches upon T1078, Valid Accounts, as the exploitation requires initial authentication but then abuses those valid credentials to escalate information gathering capabilities beyond their intended scope.
Mitigation strategies must prioritize immediate patching and robust input validation practices. Administrators running affected versions of the Project Manager plugin should upgrade immediately to version 4.0.7 or later, where this authorization check has been implemented by the developers. For environments where upgrading is not immediately feasible, temporary mitigations include restricting access to the WordPress REST API endpoints via web application firewall rules if possible, although this may impact legitimate functionality. Additionally, implementing strict role-based access control checks at the code level for all custom REST API routes is essential. Developers should ensure that every endpoint verifies both authentication and authorization before processing requests or returning data, ensuring that users can only interact with resources explicitly assigned to their roles. Regular security audits of third-party plugins are also recommended to identify similar patterns of insecure direct object references in other components.