CVE-2025-32280 WordPress WP Project Manager plugin < 2.6.25 - Cross Site Request Forgery (CSRF) Vulnerability
Attackers can trick authenticated users into performing unintended actions in the WP Project Manager plugin, potentially modifying project data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-32280?
CVE-2025-32280 is a medium-severity vulnerability in weDevs WP Project Manager, published on 4 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-Site Request Forgery (CSRF) vulnerability in weDevs WP Project Manager wedevs-project-manager allows Cross Site Request Forgery.This issue affects WP Project Manager: from n/a through < 2.6.25.
Weakness: CWE-352
Which versions are affected by CVE-2025-32280?
It affects 1 product.
Products include Wedevs Wp Project Manager.
How do I fix CVE-2025-32280?
No fix has been published for CVE-2025-32280 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-32280 being exploited?
There is no known exploitation of CVE-2025-32280 in the wild and no public exploit code.
Other vulnerabilities in weDevs WP Project Manager
- CVE-2023-3636 WP Project Manager <= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation
- CVE-2023-34383 WordPress WP Project Manager Plugin <= 2.6.0 is vulnerable to SQL Injection
- CVE-2024-10174 Auth bypass in Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- CVE-2024-13500 WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter
- CVE-2024-13752 WP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
Sources
Also known as GHSA-3fc4-pmmp-65rw.