CVE-2026-74930 — MEDIUM (4.3)

Vulnerability Description

The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email address and the details of projects they have no access to.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Related Weaknesses (CWE)

CWE-639

References

https://wpscan.com/vulnerability/cf3dba8c-29d5-45eb-9da7-e470312cbcf2/

FAQ

What is CVE-2026-74930?

CVE-2026-74930 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticate...

How severe is CVE-2026-74930?

CVE-2026-74930 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-74930?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.