CVE-2024-43916 MEDIUM

CVE-2024-43916: WordPress Zephyr Project Manager plugin <= 3.3.102 - Insecure Direct Object References (IDOR) vulnerability

Vendor Dylan James
Product Zephyr Project Manager
Weakness CWE-639 · IDOR
Published August 26, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.102.

Explanation of Vulnerability in Simple Terms

02Summary

Zephyr Project Manager versions up to 3.3.102 contain an integrity vulnerability allowing authenticated users to modify data they should not have access to. The flaw requires a valid user account and network access but no additional user interaction. The impact is limited to data modification without affecting confidentiality or system availability.

What an attacker can do

03Attacker Capabilities

Modify data in the application without proper authorization.

Potential impact on your site

04Site Impact

Authenticated users can alter project data or settings beyond their intended permissions.

Conditions required to exploit

05Prerequisites

Attacker must have a valid user account with low-level privileges.

Key dates

06Disclosure timeline

August 26, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-11988 LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter CVE-2026-13534 CherryHQ cherry-studio CherryIN Preload API MemoryService.ts sha256 authorization CVE-2026-44732 OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resources CVE-2025-59133 WordPress Projectopia plugin <= 5.1.25.2 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-12073 ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite