The Project Manager WordPress plugin before 4.0.7 does not have any authorization check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site’s registration setting.

WordPress sites using the Project Manager plugin before version 4.0.7 are affected. The vulnerability applies to all installations of the Project Manager plugin, including versions 2.1.0 through 4.0.6. No specific vendor or build is required beyond the plugin itself.

Because the attack can be performed without authentication, the potential for misuse is high. The CVSS score is not provided, and the EPSS score is unavailable, but the absence of a KEV listing does not indicate low risk. Attackers likely send crafted POST requests to the import endpoints to trigger account creation. Since the vulnerability allows setting the account password, the attacker already knows the credentials, turning the lack of authorization into a straightforward account takeover path.