The WP Project Manager plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in its REST API endpoint '/wp-json/pm/v2/projects/1/task-lists'. Authenticated users with at least Subscriber-level privileges can exploit this flaw to retrieve sensitive data, including hashed passwords of project owners. This affects all plugin versions up to 2.6.15. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting a network attack vector with low attack complexity and no user interaction required, but requiring some privileges. No patch or official fix has been documented yet.

An attacker with Subscriber-level access or higher can extract sensitive information, including hashed passwords of project owners such as administrators. This could potentially lead to further compromise if the hashes are cracked or used in other attacks. The vulnerability does not impact integrity or availability directly but compromises confidentiality of sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity. Avoid exposing the vulnerable REST API endpoint if possible through configuration or access controls.