Description

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-26T06:16:26.930Z",
  "pubdate": "2026-08-26T06:16:26.930Z",
  "executiveSummary": "The Project Manager WordPress plugin, in versions prior to 4.0.7, contains a critical security vulnerability involving improper authorization on its import functionality. This vulnerability allows an unauthenticated, remote attacker to bypass site-wide registration security settings and programmatically create new WordPress user accounts with arbitrary passwords.\nBy targeting specific, unprotected import routes, unauthorized actors can inject administrative or standard user accounts into the database. This bypasses both default registration restrictions and potential administrative controls. The risk implication is significant, as it facilitates unauthorized access, potential privilege escalation, and full site compromise by granting the attacker an entry point into the WordPress management interface.\nExploitation requires no prior authentication or administrative privileges, making it accessible to any unauthenticated user with network access to the target site. Because the vulnerability involves the plugin's internal handling of user data imports, it effectively circumvents the standard WordPress 'Membership' settings, allowing registration even when the site is configured to disallow new user sign-ups.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the import routes within the Project Manager plugin. Specifically, the plugin's codebase fails to execute proper authentication checks or nonce validation for request handlers tasked with processing user imports. In the context of WordPress plugins, such routes are intended for administrative use, yet the lack of explicit capability checks or 'is_user_logged_in()' validation allows the application to process inputs regardless of the requester's session state.\nThe exploitation flow begins with the attacker identifying the target URL endpoints associated with the plugin’s import functionalities. Because these endpoints do not verify the session token (nonce) or the requester's authorization level, the attacker can craft a direct HTTP POST request to the vulnerable endpoint. This request includes the necessary parameters to define user account details, including username, email, and the password desired by the attacker.\nUpon receiving this request, the backend code fails to intercept or reject the input, proceeding to trigger the standard WordPress user creation functions (such as wp_insert_user) or custom logic intended to map imported data to site entities. Because the plugin executes these functions without enforcing site registration policies, the account is successfully created in the WordPress 'users' and 'usermeta' database tables.\nPost-exploitation, the attacker gains a valid set of credentials that allows them to authenticate into the WordPress dashboard. Depending on the default role settings assigned to new users created via this plugin logic, the attacker could obtain a high-privileged account (such as Administrator or Editor). Even with low-privileged accounts, the attacker gains a footprint on the system that can be leveraged for further attacks, such as exploiting other vulnerable plugins, uploading malicious files via theme or plugin editors, or conducting phishing campaigns from the compromised host.\nAffected versions are identified as all iterations of the Project Manager plugin prior to version 4.0.7. The vulnerability is network-exposed, as it relies on reachable web routes provided by the WordPress installation, and requires zero interaction from an administrator. The primary failure is the complete omission of authorization middleware on administrative endpoints, allowing an unauthenticated adversary to leverage plugin infrastructure to manipulate the system's identity management system."
}