Executive brief
WP Project Manager is a WordPress plugin for managing projects and tasks across teams. The plugin's REST API endpoints fail to properly validate that users only access projects they are assigned to, allowing any authenticated user (even those with minimal permissions like subscribers) to read task details and email addresses from projects they don't belong to, and to modify task boards in other projects.
Technical details
The vulnerability is an insecure direct object reference (IDOR) / broken access control flaw in WP Project Manager's REST API endpoints. Several API routes (including /pm/v2/advanced/tasks, /pm/v2/tasks, /pm/v2/advanced/taskscsv, /pm/v2/users/{id}/tasks, and /pm/v2/projects/{id}/tasks/sorting) do not properly enforce project membership checks before returning or modifying data. Any authenticated user can enumerate and retrieve task content, user email addresses, file metadata, and comments from projects they are not members of, and can modify task boards by directly manipulating object IDs in request payloads. The vulnerability requires only a valid WordPress user account (even a subscriber role is sufficient). The issue was patched in version 4.0.7.
Affected products
- weDevs WP Project Manager before 4.0.7
Timeline
- 2026-08-24: disclosed
- 2026-08-26: advisory
- 2026-08-26: patched: Fixed in version 4.0.7