CVE-2026-74929: CWE-284 Improper Access Control in Project Manager

CVE-2026-74929 is an improper access control vulnerability (CWE-284) in the Project Manager WordPress plugin prior to version 4.0.7. The plugin fails to restrict several REST API routes to only the projects a user is a member of. As a result, authenticated users with minimal privileges can read sensitive information such as task content and user email addresses from other projects and can also modify task boards belonging to those projects. This vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with network attack vector, low attack complexity, low privileges required, no user interaction, and impacts confidentiality and integrity but not availability.

An attacker with any authenticated user account can access and modify project data they should not have permission to. This includes reading sensitive task content and user email addresses from other projects and altering task boards. The confidentiality and integrity of project data are impacted, but availability is not affected. There are no known exploits in the wild at this time.

No official patch or remediation guidance is currently available. Users should monitor the vendor's advisories for updates and apply any forthcoming patches promptly. Until a fix is released, consider restricting user roles or limiting access to the plugin's REST API routes where possible.