The flaw is a hard‑coded credentials issue that lets a malicious actor authenticate to the WP Project Manager plugin and extract sensitive data that is otherwise protected. The vulnerability is limited to data confidentiality erosion; it does not provide arbitrary code execution or denial of service. The weakness is classified as CWE‑798.

The vulnerability exists in the weDevs WP Project Manager plugin for WordPress, affecting all releases up to and including version 2.6.25. Any WordPress site that has this plugin installed and has not been updated beyond that version could be impacted.

The CVSS score of 5.3 indicates a moderate risk, while the EPSS score of less than 1% suggests that exploitation is currently unlikely and no publicly known exploits exist. The vulnerability is not listed in the CISA KEV catalog, further indicating a low exploitation probability. The likely attack vector is a remote web request directed at the plugin’s authentication endpoints, which bypasses normal security checks due to the hard‑coded credentials.