CVE-2026-74929: Project Manager WordPress Auth Bypass Flaw

CVE-2026-74929 Overview

CVE-2026-74929 is a broken access control vulnerability in the Project Manager WordPress plugin versions before 4.0.7. The plugin fails to restrict several REST API routes to projects that the requesting user belongs to. Any authenticated user, including a low-privilege subscriber, can read task content and user email addresses from other projects. The same flaw allows an attacker to modify task boards belonging to projects outside their membership. The vulnerability is tracked under CWE-284: Improper Access Control.

Critical Impact
Authenticated subscribers can read cross-project task data and email addresses, and modify task boards they do not own.

Affected Products

Project Manager WordPress plugin versions prior to 4.0.7
WordPress sites running the vulnerable plugin with open user registration
Multi-tenant WordPress installations exposing subscriber-level accounts

Discovery Timeline

2026-08-26 - CVE-2026-74929 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-74929

Vulnerability Analysis

The Project Manager plugin exposes several REST API endpoints for retrieving and modifying project data. These endpoints authenticate the caller but do not verify project membership before returning or accepting data. As a result, authorization is enforced only at the WordPress role layer, not at the object level.

An attacker holding any authenticated session, including the default subscriber role, can invoke the affected REST routes with arbitrary project or task identifiers. The server returns task contents and associated user email addresses from projects the caller has never been added to. The same routes accept write operations that update task boards outside the caller's project scope.

The issue is a textbook Insecure Direct Object Reference combined with missing authorization checks. Impact is bounded to confidentiality of task-level data and integrity of task boards; the underlying WordPress core and site availability are not directly affected.

Root Cause

The root cause is the absence of project-membership validation in the REST controller callbacks. Permission callbacks check that a user is logged in but never call a helper such as user_can_access_project($project_id) before returning or persisting data. This maps to CWE-284.

Attack Vector

Exploitation requires a valid WordPress account on the target site. The attacker sends authenticated HTTP requests to the plugin's REST routes and substitutes project or task identifiers belonging to other tenants. No user interaction and no elevated privileges are required beyond a subscriber-level login.

No proof-of-concept code is published in verified sources. Refer to the WPScan Vulnerability Report for advisory details.

Detection Methods for CVE-2026-74929

Indicators of Compromise

Authenticated REST API requests to /wp-json/pm/ routes from accounts with the subscriber role
Unexpected POST or PUT requests to task board endpoints from users not assigned to the target project
Access log entries showing sequential enumeration of project or task identifiers

Detection Strategies

Enable WordPress REST API request logging and correlate caller role against the project scope of each request
Audit the plugin's database tables for task board edits performed by users absent from the project membership table
Alert on any subscriber-role account issuing write requests to plugin REST endpoints

Monitoring Recommendations

Monitor for spikes in /wp-json/ traffic from newly registered accounts
Track outbound data volumes from REST responses that include email address fields
Review new user registrations on sites that allow open subscriber signup

How to Mitigate CVE-2026-74929

Immediate Actions Required

Update the Project Manager plugin to version 4.0.7 or later on all WordPress installations
Disable open user registration on sites that do not require it until patching is complete
Review existing subscriber accounts for signs of unauthorized activity against project data

Patch Information

The vendor addressed the issue in Project Manager version 4.0.7. The fix adds project-membership checks to the affected REST API permission callbacks. Consult the WPScan Vulnerability Report for the coordinated advisory.

Workarounds

Restrict access to the plugin's REST routes at the web server or WAF layer for non-admin roles until the update is applied
Temporarily deactivate the Project Manager plugin on sites where an immediate update is not possible
Rotate email addresses or sensitive task content that may have been exposed to untrusted subscribers

bash

# Example: block plugin REST routes for unauthenticated and low-privilege traffic at the WAF
# Nginx location snippet
location ~ ^/wp-json/pm/ {
    if ($http_x_wp_role !~ "administrator|editor|project_manager") {
        return 403;
    }
}