CVE-2026-74930: WP Project Manager unauthorized activity disclosure via IDOR

CVE-2026-74930 · Severity: medium · CVSS 4.3 · Published 2026-08-26

WP Project Manager is a WordPress plugin used to organize projects and tasks within WordPress sites. A flaw in its REST API allows any logged-in user—even one with minimal permissions like a subscriber—to view other users' complete activity histories, including private email addresses, and project details they should not have access to. This enables unauthorized disclosure of sensitive business information and employee email addresses.

Technologies: weDevs WP Project Manager. Vendors: weDevs.

Quick answers

Is CVE-2026-74930 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-74930 being exploited in the wild.
How severe is CVE-2026-74930?
Medium severity, with a CVSS score of 4.3, published 26 August 2026.
Which products and versions are affected?
weDevs WP Project Manager 2.2.0 through 4.0.6.
Is there a fix for CVE-2026-74930?
A patch was published on 2026-08-26: Fixed in version 4.0.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74930 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-74930?
Check whether you run weDevs WP Project Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the WP Project Manager REST API routes `/pm/v2/users/{ID}/user-activities` and `/pm/v2/users/{ID}/tasks`. These endpoints fail to verify that the requesting user is authorized to access the target user's data before returning activity feeds, email addresses, and project information. An authenticated attacker with any role (including subscriber) can substitute an arbitrary user ID and retrieve complete activity logs, email addresses, usernames, roles, and sensitive project details (title, description, budget, completion date) that they should not have permission to view. Exploitation requires only valid WordPress authentication and a nonce; no additional privileges or complex attack steps are needed. The vulnerability affects versions 2.2.0 through 4.0.6 and is fixed in version 4.0.7.

Affected products

  • wedevs WP Project Manager 2.2.0 through 4.0.6

Timeline

  • 2026-08-24: disclosed: Publicly published on WPScan
  • 2026-08-26: patched: Fixed in version 4.0.7
  • 2026-08-26: other: CVE-2026-74930 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.