vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2024-13752

WP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update

MEDIUM
6.5
CVSS Score
Published: February 15, 2025 at 09:24 AM UTC
Updated: June 17, 2026 at 07:02 AM UTC
1 product affected across 1 vendorWP Project Manager

Using WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts by wedevs?

Get instant alerts when new vulnerabilities affect WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.5
Exploit prediction
EPSS 0.5%
SSVC
No known exploit

Description

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the '/pm/v2/settings/notice' endpoint all versions up to, and including, 2.6.17. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cause a persistent denial of service condition.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

WP Project Manager· Wedevswordpress-plugin
95%
v ≤ 2.6.17v < 2.6.18
Affected range stops below 2.6.18, so it looks safe — our inference, not a vendor statement

References (7)

Product
Source: [email protected]
https://plugins.trac.wordpress.org/browser/wedevs-project-manager/trunk/core/Upgrades/Upgrade_2_0.php#L255
Product
Source: [email protected]
https://plugins.trac.wordpress.org/browser/wedevs-project-manager/trunk/core/Upgrades/Upgrade_2_3.php#L151
Patch
Source: [email protected]
https://plugins.trac.wordpress.org/changeset/3239348/
Patch
Source: [email protected]
https://plugins.trac.wordpress.org/changeset?old_path=%2Fwedevs-project-manager%2Ftags%2F2.6.17%2Fsrc%2FSettings%2FControllers%2FSettings_Controller.php&old=3213295&new_path=%2Fwedevs-project-manager%2Ftags%2F2.6.18%2Fsrc%2FSettings%2FControllers%2FSettings_Controller.php&new=3240807&sfp_email=&sfph_mail=
Patch
Source: [email protected]
https://plugins.trac.wordpress.org/changeset?old_path=%2Fwedevs-project-manager%2Ftrunk%2Froutes%2Fsettings.php&old=3213295&new_path=%2Fwedevs-project-manager%2Ftrunk%2Froutes%2Fsettings.php&new=3240806&sfp_email=&sfph_mail=
ProductRelease Notes
Source: [email protected]
https://wordpress.org/plugins/wedevs-project-manager/#developers
Third Party Advisory
Source: [email protected]
https://www.wordfence.com/threat-intel/vulnerabilities/id/bd54a50b-13ce-43ce-bce1-8fe132abc07e?source=cve

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.5MEDIUMWordfence
Vector?

Quick Info

StatusANALYZED
CWE
CWE-862

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card