What’s Vulnerable › Vulnerabilities
CVE-2026-74930: WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-26 · updated 2026-08-26
- Weakness: CWE-639
Description
The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email address and the details of projects they have no access to.
Affected products
- Project Manager: from 2.2.0 before 4.0.7 — fixed in 4.0.7
How to fix
Upgrade to a fixed version: Project Manager 4.0.7. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-74930 or the next vulnerability affects your stack