What’s Vulnerable › Vulnerabilities

CVE-2024-10520: WP Project Manager <= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-20 · updated 2026-06-17
• Weakness: CWE-862

Description

The WP Project Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'check' method of the 'Create_Milestone', 'Create_Task_List', 'Create_Task', and 'Delete_Task' classes in version 2.6.14. This makes it possible for unauthenticated attackers to create milestones, create task lists, create tasks, or delete tasks in any project. NOTE: Version 2.6.14 implemented a partial fix for this vulnerability.

Affected products

• wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker: before 2.6.15 — fixed in 2.6.15

How to fix

Upgrade to a fixed version: wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker 2.6.15. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/3191204/wedevs-project-manager
• https://www.wordfence.com/threat-intel/vulnerabilities/id/497760a8-7d4a-45a0-91e4-a8ee27bcdb02?source=cve

Get alerted when CVE-2024-10520 or the next vulnerability affects your stack