Executive brief
The WP Project Manager WordPress plugin is used to manage projects and tasks within WordPress sites. The plugin's import functionality lacks authorization checks, allowing an unauthenticated attacker to create WordPress user accounts with a known password, bypassing the site's registration settings. This could lead to unauthorized account access and potential site compromise even on sites with registration disabled.
Technical details
The plugin exposes REST API endpoints (pm/v2/trello/get_users and related import routes) without proper authorization checks, allowing unauthenticated POST requests. The vulnerability exists in the Trello import functionality which creates WordPress user accounts with usernames derived from Trello member profiles and a hardcoded password embedded in the plugin code. An attacker with a free Trello account can craft a malicious import request containing their own Trello API credentials and card data to trigger account creation on the victim site. The attacker gains knowledge of the fixed password from the plugin code, enabling account takeover. The issue affects all import routes (Trello users, projects, task lists, tasks, and sub-tasks). The vulnerability was fixed in version 4.0.7.
Affected products
- weDevs WP Project Manager before 4.0.7
Timeline
- 2026-08-24: disclosed
- 2026-08-26: patched: Fixed in version 4.0.7