CVE-2023-40003 WordPress WP Project Manager plugin <= 2.6.7 - Broken Access Control vulnerability

What is CVE-2023-40003?

CVE-2023-40003 is a medium-severity missing authorization vulnerability in weDevs WP Project Manager, published on 13 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Missing Authorization vulnerability in weDevs WP Project Manager wedevs-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Project Manager: from n/a through <= 2.6.7.

Weakness: CWE-862

Which versions are affected by CVE-2023-40003?

It affects 1 product.

Products include Wedevs Wp Project Manager.

How do I fix CVE-2023-40003?

No fix has been published for CVE-2023-40003 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-40003 being exploited?

There is no known exploitation of CVE-2023-40003 in the wild and no public exploit code.

Other vulnerabilities in weDevs WP Project Manager

• CVE-2023-3636 WP Project Manager <= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation High 8.8
• CVE-2023-34383 WordPress WP Project Manager Plugin <= 2.6.0 is vulnerable to SQL Injection High 8.5
• CVE-2024-10174 Auth bypass in Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker High 7.3
• CVE-2024-13500 WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter Medium 6.5
• CVE-2024-13752 WP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m9cr-g8p8-8x4r.