CVE-2024-13752
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
15/02/2025
Last modified:
24/02/2025
Description
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the '/pm/v2/settings/notice' endpoint all versions up to, and including, 2.6.17. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cause a persistent denial of service condition.
Impact
Base Score 3.x
6.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:wedevs:wp_project_manager:*:*:*:*:*:wordpress:*:* | 2.6.18 (excluding) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://plugins.trac.wordpress.org/browser/wedevs-project-manager/trunk/core/Upgrades/Upgrade_2_0.php#L255
- https://plugins.trac.wordpress.org/browser/wedevs-project-manager/trunk/core/Upgrades/Upgrade_2_3.php#L151
- https://plugins.trac.wordpress.org/changeset/3239348/
- https://plugins.trac.wordpress.org/changeset?old_path=/wedevs-project-manager/tags/2.6.17/src/Settings/Controllers/Settings_Controller.php&old=3213295&new_path=/wedevs-project-manager/tags/2.6.18/src/Settings/Controllers/Settings_Controller.php&new=3240807&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/changeset?old_path=/wedevs-project-manager/trunk/routes/settings.php&old=3213295&new_path=/wedevs-project-manager/trunk/routes/settings.php&new=3240806&sfp_email=&sfph_mail=
- https://wordpress.org/plugins/wedevs-project-manager/#developers
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bd54a50b-13ce-43ce-bce1-8fe132abc07e?source=cve