The WP Project Manager plugin for WordPress, up to version 2.6.13, contains an authorization bypass vulnerability (CWE-639) due to insufficient validation of the 'user_id' parameter in the Abstract_Permission class. This allows unauthenticated attackers to impersonate administrators and access all REST API endpoints of the plugin. The vulnerability is classified as an Insecure Direct Object Reference (IDOR). It has a CVSS 3.1 base score of 7.3, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or remediation details are currently provided by the vendor.

An unauthenticated attacker can exploit this vulnerability to bypass authorization controls by spoofing the 'user_id' parameter, effectively impersonating an administrator. This grants full access to all REST API routes of the WP Project Manager plugin, potentially allowing unauthorized data access, modification, or disruption of project management functions. The impact includes confidentiality, integrity, and availability losses at a high severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the WP Project Manager plugin or restricting access to its REST API endpoints to trusted users only. Monitor the vendor's communications for updates and apply official patches immediately upon availability.