high7.5
CVE-2026-74928
The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPres…
Impact
The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting.
Affected products
| Product | Affected versions |
|---|---|
| Project Manager WordPress Plugin | before 4.0.7 |
Versions were read from the advisory text. No structured product data has been published for this record yet.