CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Insertion of Sensitive Information Into Sent Data vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 3.0.1.
Explanation of Vulnerability in Simple Terms
WP Project Manager versions 3.0.1 and earlier contain an information disclosure vulnerability. An attacker with low-level site access can read sensitive data they should not have permission to view. The vulnerability requires valid user credentials but no additional user interaction. Update to a version newer than 3.0.1 to resolve this issue.
What an attacker can do
Read sensitive data from the plugin that should be restricted to higher-privilege users.
Potential impact on your site
User data, project details, or other confidential information may be exposed to low-privilege site members.
Conditions required to exploit
Valid WordPress user account with low-level permissions (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
