Quick answers
- Is CVE-2026-74929 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-74929 being exploited in the wild.
- How severe is CVE-2026-74929?
- Medium severity, with a CVSS score of 5.4, published 26 August 2026.
- Which products and versions are affected?
- weDevs WP Project Manager before 4.0.7.
- Is there a fix for CVE-2026-74929?
- A patch was published on 2026-08-26: Fixed in version 4.0.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-74929 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-74929?
- Check whether you run weDevs WP Project Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an insecure direct object reference (IDOR) / broken access control flaw in WP Project Manager's REST API endpoints. Several API routes (including /pm/v2/advanced/tasks, /pm/v2/tasks, /pm/v2/advanced/taskscsv, /pm/v2/users/{id}/tasks, and /pm/v2/projects/{id}/tasks/sorting) do not properly enforce project membership checks before returning or modifying data. Any authenticated user can enumerate and retrieve task content, user email addresses, file metadata, and comments from projects they are not members of, and can modify task boards by directly manipulating object IDs in request payloads. The vulnerability requires only a valid WordPress user account (even a subscriber role is sufficient). The issue was patched in version 4.0.7.
Affected products
- weDevs WP Project Manager before 4.0.7
Timeline
- 2026-08-24: disclosed
- 2026-08-26: advisory
- 2026-08-26: patched: Fixed in version 4.0.7