CVE-2024-10520

Summary

CVE-2024-10520 is a vulnerability affecting the WP Project Manager plugin for WordPress in version 2.6.14. The issue lies in the missing capability checks in the 'Create_Milestone', 'Create_Task_List', 'Create_Task', and 'Delete_Task' classes, resulting in unauthorized data modification. Unauthenticated attackers can exploit this flaw to create milestones, task lists, tasks, or delete tasks in any project. Notably, version 2.6.14 includes a partial fix for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.