CVE-2024-10174highCWE-639

CVE-2024-10174: fallo de gravedad alta en wedevs Project Manager – AI Powered Project…

WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.13 - Insecure Direct Object Reference to Unauthenticated Authorization Bypass

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.3epss 0.7%
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.13 via the 'Abstract_Permission' class due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to spoof their identity to that of an administrator and access all of the plugins REST routes.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Productos afectados
wedevs · Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
CVEs relacionadas — wedevs Project Manager – AI Powered Project…

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-3636HIGHWP Project Manager <= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege EscalationEPSS 0.9%CVE-2026-116512CRITICALProject Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function InjectionEPSS 0.6%CVE-2024-13752MEDIUMWP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options UpdateEPSS 0.5%CVE-2024-12195MEDIUMWP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.16 - Authenticated (Subscriber+) SQL InjectionEPSS 0.4%CVE-2020-36745MEDIUMWP Project Manager <= 2.4.0 - Cross-Site Request Forgery BypassEPSS 0.4%CVE-2024-13500MEDIUMWP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby ParameterEPSS 0.4%