WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts, CVE-2024-10548

CVE, Research URL: CVE-2024-10548
Home page URL: Security reports for WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
Application: WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
Published on: Dec 19, 2024
Research Description: The WP Project Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.15 via the Project Task List ('/wp-json/pm/v2/projects/1/task-lists') REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including the hashed passwords of project owners (e.g. adminstrators).
Affected versions: Min -, max 2.6.16.
Status: vulnerable

WP Project Manager &#8211; Task, team, and project management plugin featuring kanban board and gantt charts, CVE-2024-10548