An unauthenticated account creation vulnerability in the Project Manager WordPress plugin poses a high risk of unauthorized administrative or user access.

This flaw is a missing authorization issue (CWE-862) located in the plugin import routes. It allows an unauthenticated attacker to inject new user accounts into the WordPress database with known passwords, effectively bypassing standard registration security controls.

Successful exploitation allows unauthorized entities to gain access to the WordPress environment, potentially leading to privilege escalation or full site takeover. With a CVSS score of 7.5, this high-severity vulnerability represents a significant risk to data integrity and site security. Unauthorized account creation can facilitate further malicious activity, such as data theft, defacement, or the installation of backdoors.

Immediate Action: Update the Project Manager plugin to version 4.0.7 or later to implement the necessary authorization checks on import routes.

Proactive Monitoring: Review WordPress user registration logs for anomalous account creation events or accounts created with unexpected credentials.

Compensating Controls: If immediate patching is not feasible, disable the Project Manager plugin entirely until a verified update is applied.

Public Exploit Available: Unknown

Given the ease of exploitation, security teams must prioritize updating the Project Manager plugin to version 4.0.7 immediately. Failure to address this vulnerability allows attackers to bypass registration settings and gain unauthorized entry into the application. Consistent monitoring of user accounts and plugin updates is essential to maintain the security posture of the WordPress environment.