CVE-2023-3636highCWE-269

CVE-2023-3636: falha de alta gravidade em wedevs Project Manager – AI Powered Project…

WP Project Manager <= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.9%
The WP Project Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.6.4 due to insufficient restriction on the 'save_users_map_name' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'usernames' parameter.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
wedevs · Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
CVEs relacionadas — wedevs Project Manager – AI Powered Project…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-10174HIGHWP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.13 - Insecure Direct Object Reference to Unauthenticated Authorization BypassEPSS 0.7%CVE-2026-116512CRITICALProject Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function InjectionEPSS 0.6%CVE-2024-13752MEDIUMWP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options UpdateEPSS 0.5%CVE-2024-12195MEDIUMWP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.16 - Authenticated (Subscriber+) SQL InjectionEPSS 0.4%CVE-2020-36745MEDIUMWP Project Manager <= 2.4.0 - Cross-Site Request Forgery BypassEPSS 0.4%CVE-2024-13500MEDIUMWP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby ParameterEPSS 0.4%