Auth bypass in Project Manager
CVE-2026-74930
The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email address and the details of projects they have no access to.
Vulnerability class: IDOR (Insecure Direct Object Reference)
EPSS: 0.002 (5.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Unknown Project Manager
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-74930?
- CVE-2026-74930 is a medium-severity vulnerability in Project Manager, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.3/10. Published 2026-08-26.
- How severe is CVE-2026-74930?
- Medium severity. CVSS v3 base score is 4.3 out of 10.