The weDevs WP Project Manager plugin contains a CSRF flaw that permits an attacker to trick a logged‑in user into submitting malformed requests to the plugin’s backend. If successful, the victim can perform actions that the plugin does not properly verify, such as modifying or deleting project data, potentially leading to data loss, unauthorized changes, or service disruption. This weakness is identified as CWE‑352, illustrating that the application fails to validate request authenticity.

The vulnerability exists in the weDevs WP Project Manager plugin for all releases older than 2.6.25. Users running any version prior to 2.6.25 are affected.

The CVSS score of 4.3 indicates moderate severity, while the EPSS of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread attacks. Exploitation would likely occur via a malicious website that forces the target user’s browser to send a request to the plugin’s endpoint while the user is authenticated, thereby abusing the missing CSRF token protection.