An unauthenticated authorization bypass in the Project Manager WordPress plugin allows attackers to create unauthorized administrative or user accounts, threatening site integrity.

The plugin lacks authorization checks on its import routes, which permits unauthenticated attackers to register new WordPress accounts. This bypasses the site's configured registration settings and allows the attacker to specify a password of their choosing.

This vulnerability is rated at 7.5 on the CVSS scale, representing a high risk of unauthorized access. By creating arbitrary accounts, an attacker could gain a foothold within the application, potentially leading to further exploitation, data exfiltration, or the defacement of the WordPress site.

Immediate Action: Update the Project Manager WordPress plugin to version 4.0.7 or later.

Proactive Monitoring: Monitor the WordPress user database for the creation of suspicious or unauthorized accounts and review access logs for requests hitting import-related endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block unauthorized access to plugin import routes and temporarily disable the plugin if an update cannot be applied immediately.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced WPScan vulnerability entry.

The severity of this issue necessitates an immediate update to version 4.0.7 or later. Site administrators should conduct an audit of their current user list to identify any accounts created through unauthorized means and remove them promptly.