CVE-2026-74928 — WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a…

Published: 2026-08-26 · CVSS: 7.5 · CVSS 3.1

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting.

Original CVE JSON · STIX 2.1

Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7