CVE-2024-10548

Summary

CVE-2024-10548 is a newly identified vulnerability affecting the WP Project Manager plugin for WordPress. This issue allows authenticated attackers with Subscriber-level access or higher to extract sensitive data through the plugin's Project Task List REST API endpoint. The vulnerability, located at '/wp-json/pm/v2/projects/1/task-lists', exposes sensitive information, including the hashed passwords of project owners, putting WordPress administrators at risk. Versions of the plugin up to and including 2.6.15 are vulnerable to this Sensitive Information Exposure vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.