Description

The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-26T06:16:27.037Z",
  "pubdate": "2026-08-26T06:16:27.037Z",
  "executiveSummary": "The Project Manager WordPress plugin, in versions prior to 4.0.7, suffers from a critical Broken Access Control vulnerability within its REST API implementation. This flaw stems from a failure to perform proper authorization checks on specific API endpoints, effectively decoupling access control from project membership requirements.\nThe vulnerability allows any authenticated user, including those with minimal privileges such as 'subscriber' roles, to interact with project data they are not authorized to access. An attacker can perform unauthorized read operations to harvest sensitive information—including task content and private user email addresses—and execute unauthorized write operations to modify task boards.\nThe impact is significant, as it leads to widespread unauthorized information disclosure and loss of data integrity across the project management environment. Because the vulnerability is accessible via the standard REST API, it can be exploited remotely by any registered user without requiring elevated administrative or project-manager privileges. The risk is particularly acute for organizations managing confidential or proprietary data within the WordPress ecosystem, as the vulnerability circumvents intended tenant isolation and project-level privacy controls.",
  "technicalDetails": "The root cause of this vulnerability is improper implementation of access control checks within the Project Manager plugin's REST API controller logic. Specifically, the plugin fails to validate whether the current requesting user possesses the necessary permissions or membership status associated with the project targeted by the API request.\nThe affected component is the REST API infrastructure provided by the Project Manager plugin. In typical WordPress development, custom REST API endpoints should define a 'permission_callback' function to verify user authentication and, more importantly, authorization against the requested resource. The vulnerable versions of this plugin either omit these callbacks entirely for sensitive routes or implement them with insufficient logic that only checks for general authentication rather than per-project authorization.\nExploitation is straightforward and does not require complex payloads. An authenticated attacker can identify the REST API endpoints associated with the plugin through traffic analysis or by examining the plugin's registered routes. By observing the API calls made during normal operation, an attacker can determine the request structure required to read or modify project data.\nThe attack flow follows these steps: 1. The attacker logs into the WordPress site with an account that has low-privileged access (e.g., 'subscriber'). 2. The attacker crafts a request to a vulnerable REST API endpoint (such as those handling task retrieval or board updates), specifying the ID of a project to which they do not belong. 3. The server receives the request, identifies the user as 'authenticated' based on their session cookie or nonce, and proceeds to process the request without verifying if the user has been granted access to the specific project ID. 4. The application logic retrieves or updates the data, returning the requested information or confirming the modification to the attacker.\nThe lack of strict authorization enables persistent unauthorized interaction. In terms of impact, the disclosure of user email addresses constitutes a privacy violation that may facilitate targeted phishing attacks against organization members. Furthermore, the ability to modify task boards allows an attacker to disrupt workflows, delete critical project information, or inject malicious content, resulting in significant operational integrity loss. This vulnerability is exposed over the network, making it reachable by any registered user globally if the site allows registration."
}