CVE-2026-74930 Overview
CVE-2026-74930 is an Insecure Direct Object Reference (IDOR) vulnerability in the WP Project Manager WordPress plugin before version 4.0.7. The plugin exposes a REST API route that fails to verify whether the requesting user matches the user whose activity is being queried. Any authenticated user, including a low-privileged subscriber, can read another user's activity history, email address, and details of projects they should not access. The flaw is categorized under [CWE-639: Authorization Bypass Through User-Controlled Key].
Critical Impact
Authenticated subscribers can exfiltrate activity logs, email addresses, and private project details belonging to other users on the WordPress site.
Affected Products
- WP Project Manager WordPress plugin versions before 4.0.7
- WordPress sites permitting subscriber-level registration
- Installations exposing the plugin's REST API routes to authenticated users
Discovery Timeline
- 2026-08-26 - CVE-2026-74930 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-74930
Vulnerability Analysis
The WP Project Manager plugin registers a REST API route that returns user activity data. The route accepts a user identifier as a parameter but does not validate that the identifier matches the currently authenticated caller. This missing check allows any logged-in user to substitute an arbitrary user ID and receive the associated response payload.
The returned data includes activity history, the target user's email address, and details of projects the requesting user has no authorization to view. Because subscriber accounts are commonly self-registerable on many WordPress deployments, the effective attack surface extends to anyone who can create an account.
Root Cause
The root cause is missing authorization enforcement on a REST API endpoint. The plugin performs an authentication check but omits an ownership check comparing the request's user identifier against the current session. This pattern maps directly to [CWE-639], where access control decisions rely on a user-supplied key without server-side validation.
Attack Vector
Exploitation requires only a valid authenticated session at subscriber level or higher. An attacker sends a crafted request to the vulnerable REST API route, iterating user IDs to enumerate activity records across the site. No user interaction from the victim is needed. See the WPScan Vulnerability Report for endpoint details.
// No verified proof-of-concept code is available.
// Exploitation involves issuing an authenticated HTTP request
// to the plugin's REST route with a target user_id parameter
// that does not belong to the caller.
Detection Methods for CVE-2026-74930
Indicators of Compromise
- Repeated authenticated REST API requests to WP Project Manager routes with sequential or varying user_id parameters from a single subscriber account.
- Unusual volumes of activity-log or project-detail responses returned to non-administrative accounts.
- Newly registered subscriber accounts accessing project management endpoints shortly after login.
Detection Strategies
- Review WordPress and web server access logs for requests to /wp-json/ routes exposed by the Project Manager plugin, correlating requester ID with the queried user parameter.
- Alert when a single authenticated session queries multiple distinct user IDs within a short window.
- Baseline expected REST API usage per role and flag subscriber accounts issuing project-manager API calls.
Monitoring Recommendations
- Enable verbose REST API request logging on WordPress and forward logs to a centralized platform for analysis.
- Monitor plugin version inventory and flag any WP Project Manager instance below 4.0.7.
- Track new user registrations and correlate registration events with subsequent REST API access patterns.
How to Mitigate CVE-2026-74930
Immediate Actions Required
- Upgrade WP Project Manager to version 4.0.7 or later on all WordPress installations.
- Audit existing user accounts and remove unused or suspicious subscriber-level accounts.
- Review recent access logs for evidence of enumeration against Project Manager REST routes.
Patch Information
The vendor addressed the issue in WP Project Manager 4.0.7 by enforcing that the requesting user matches the user whose activity is being queried. Site administrators should apply the update through the WordPress plugin dashboard. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Disable the WP Project Manager plugin until the patch can be applied if the affected REST route is not required.
- Restrict new user registration or set the default role to a value that limits REST API exposure.
- Use a web application firewall rule to block subscriber-level requests to the plugin's activity endpoints.
# Update WP Project Manager via WP-CLI
wp plugin update wedevs-project-manager --version=4.0.7
# Verify installed version
wp plugin get wedevs-project-manager --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
