SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-74928

HIGH · CVSS 7.5 EPSS 0.31%

Source: NVD + CISA KEV + EPSS · Published 2026-08-26 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

The Project Manager plugin for WordPress versions prior to 4.0.7 is vulnerable due to a lack of authorization checks on its import routes, enabling unauthenticated users to create accounts with predetermined passwords. This could lead to unauthorized access and potential compromise of the affected WordPress sites. WordPress administrators using this plugin should prioritize updating to the latest version to mitigate this high-severity risk.

CVE
CVE-2026-74928
Severity
HIGH
CVSS
7.5
EPSS
0.31%
WordPress

Original NVD Description

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting.