This vulnerability is a broken access control issue (CWE-862) in WP Project Manager versions up to 4.0.7. It allows users with subscriber-level privileges to perform actions or access resources that should be restricted, potentially leading to unauthorized information disclosure or modification and service disruption. The CVSS 3.1 base score is 6.3, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An attacker with subscriber privileges can exploit this missing authorization to access or modify data or functionality beyond their intended permissions. This may result in limited confidentiality loss, integrity compromise, and availability degradation within the affected WP Project Manager plugin environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber privileges where possible and monitor for unusual activity related to WP Project Manager plugin usage.