CVE-2026-74930mediumCWE-639

CVE-2026-74930: fallo de gravedad media en Project Manager

WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR

Publicada el

Seguir esta CVE+ Monitorear Project Manager

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 4.3epss 0.3%
The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email address and the details of projects they have no access to.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Productos afectados
Unknown · Project Manager
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Project Manager

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-74928HIGHWP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import RoutesEPSS 0.4%CVE-2026-74929MEDIUMWP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOREPSS 0.2%