Unknown Project Manager vulnerabilities

3 CVEs affecting Unknown Project Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-74930, published 2026-08-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-74928, published 2026-08-26. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker…
CVE-2026-74930, published 2026-08-26. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any…
CVE-2026-74929, published 2026-08-26. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read…