CVE-2024-10520: WP Project Manager Auth Bypass Vulnerability

CVE-2024-10520 Overview

CVE-2024-10520 affects the WP Project Manager plugin for WordPress. The plugin fails to enforce capability checks in the check method of the Create_Milestone, Create_Task_List, Create_Task, and Delete_Task classes. Unauthenticated attackers can create milestones, create task lists, create tasks, or delete tasks in any project. The flaw is classified as Missing Authorization [CWE-862]. Version 2.6.14 introduced only a partial fix, so administrators must confirm remediation status against vendor updates.

Critical Impact

Unauthenticated remote attackers can modify or delete project data in any WP Project Manager project on affected WordPress sites.

Affected Products

• wedevs WP Project Manager plugin for WordPress
• Versions up to and including 2.6.14 (partial fix in 2.6.14)
• WordPress sites running the vulnerable plugin

Discovery Timeline

• 2024-11-20 - CVE-2024-10520 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10520

Vulnerability Analysis

The vulnerability resides in the check method used by several task and milestone handler classes within the WP Project Manager plugin. The check method is intended to validate whether the requester has permission to perform the action. In vulnerable releases, this method omits a capability check, allowing any HTTP caller — including unauthenticated visitors — to invoke the underlying create and delete operations. Attackers can inject unauthorized milestones, task lists, and tasks, or delete existing tasks across any project managed by the plugin. The result is integrity impact on project data without any authentication or user interaction.

Root Cause

The root cause is a missing authorization control [CWE-862] in the check method of the Create_Milestone, Create_Task_List, Create_Task, and Delete_Task classes. The method does not call a WordPress capability check such as current_user_can() before executing privileged operations. According to the vendor advisory, version 2.6.14 implemented only a partial fix, meaning some code paths remain reachable without proper authorization.

Attack Vector

Exploitation occurs over the network with low complexity and requires no privileges or user interaction. An attacker sends crafted HTTP requests to the plugin endpoints that dispatch to the affected classes. Because the check method returns a permissive result, the request proceeds to the task or milestone handler and modifies project data. The vulnerability manifests through the plugin's request handling flow rather than through any injected payload. See the Wordfence Vulnerability Report and the WordPress Plugin Change Log for technical details.

Detection Methods for CVE-2024-10520

Indicators of Compromise

• Unexpected milestones, task lists, or tasks appearing in projects that were not created by known users.
• Missing or deleted tasks that legitimate users did not remove.
• Anonymous or unauthenticated requests to WP Project Manager REST endpoints in web server logs.
• Sudden spikes in POST or DELETE requests targeting plugin routes containing pm/ or project-manager.

Detection Strategies

• Audit the plugin version installed on all WordPress hosts and flag any instance at or below 2.6.14.
• Review WordPress activity logs and the plugin's internal audit trail for task and milestone changes with no associated user ID.
• Compare current project data against known-good backups to identify unauthorized additions or deletions.

Monitoring Recommendations

• Enable verbose access logging on the web server and forward logs to a centralized platform for correlation.
• Alert on unauthenticated requests reaching WP Project Manager AJAX or REST routes.
• Monitor for high-volume automated scanning against WordPress plugin endpoints from single source addresses.

How to Mitigate CVE-2024-10520

Immediate Actions Required

• Update WP Project Manager to the latest available release beyond 2.6.14 that fully addresses the missing capability check.
• Inventory all WordPress sites running the plugin and prioritize public-facing deployments.
• Restore any tampered project data from a known-good backup after confirming remediation.

Patch Information

The vendor released a partial fix in version 2.6.14, referenced in the WordPress Plugin Change Log. Administrators should upgrade to the most recent release that completes the authorization check across all affected classes and verify remediation using the Wordfence Vulnerability Report.

Workarounds

• Deactivate the WP Project Manager plugin until a complete fix can be applied.
• Restrict access to WordPress AJAX and REST endpoints using a web application firewall rule set that blocks unauthenticated requests to plugin routes.
• Limit inbound access to trusted IP ranges for project management functionality where feasible.

# Configuration example: temporarily block unauthenticated access to the plugin endpoints via nginx
location ~* /wp-admin/admin-ajax.php {
    if ($arg_action ~* "pm_|project_manager_") {
        return 403;
    }
}