Vulnerability · Published Aug 26, 2026 · Assigned by WPScan
CVE-2026-74928WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes
High 7.5
In plain English
A high-severity missing authorization in Project Manager from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 65.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Project Manager | 2.1.0 – before 4.0.7 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://wpscan.com/vulnerability/667093bc-e030-45ff-83e0-0d5a4f3abc16/ exploit, vdb-entry, technical-description