CVE-2026-3977 MEDIUM

CVE-2026-3977: projectsend AJAX Endpoints authorization

Vendor N/A

Product projectsend

Weakness CWE-862 · Missing authorization

Published March 12, 2026

Last update March 12, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

What the vulnerability does

01Description

A security vulnerability has been detected in projectsend up to r1945. The affected element is an unknown function of the component AJAX Endpoints. The manipulation leads to missing authorization. The attack can be initiated remotely. The identifier of the patch is 35dfd6f08f7d517709c77ee73e57367141107e6b. To fix this issue, it is recommended to deploy a patch.

Key dates

02Disclosure timeline

March 12, 2026 CVE published

March 12, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-3977 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2024-13687 Team Builder – Meet the Team <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update CVE-2023-52229 WordPress Word Replacer Pro plugin <= 1.0 - Broken Access Control vulnerability CVE-2025-54040 WordPress Webba Booking <= 5.1.20 - Broken Access Control Vulnerability CVE-2024-25092 WordPress NextMove Lite plugin <= 2.17.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability CVE-2025-13828 Mautic user without privileged access to the Marketplace can install and uninstall composer packages