CVE-2024-10548

Published: Dec 19, 2024Modified: Feb 5, 2025

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security@wordfence.com (Secondary)

Description

The WP Project Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.15 via the Project Task List ('/wp-json/pm/v2/projects/1/task-lists') REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including the hashed passwords of project owners (e.g. adminstrators).

Affected (1)

Products: Wedevs: Wp Project Manager

1 product

Wp Project Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wedevs Wp Project Manager	Before 2.6.16

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://plugins.trac.wordpress.org/changeset/3206717/wedevs-project-manager/tags/2.6.16/src/Task_List/Controllers/Task_List_Controller.php

Source: security@wordfence.com

Patch

https://www.wordfence.com/threat-intel/vulnerabilities/id/a21b7c40-2090-4262-9105-346db2325612?source=cve

Source: security@wordfence.com

Third Party Advisory

Timeline

No history available yet.