CVE-2026-74928

WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting.

Affected

Project Manager

CVSS v3.1 CNA

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.40% chance of exploitation in the next 30 days, 33rd percentile

Published

2026-08-26

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/667093bc-e030-45ff-83e0-0d5a4f3abc16/

References

• CVE Record
• NVD entry