The vulnerability arises from inadequate authorization checks on several REST API routes within the Project Manager WordPress plugin. An authenticated user, even with a low-level role such as a subscriber, can query or modify any task belonging to projects they are not a member of. This lack of restriction enables the disclosure of task content and associated user email addresses and permits unauthorized alteration of other projects' task boards.

Any WordPress site that installs the Project Manager plugin before version 4.0.7 is susceptible. The plugin provides a project‑management interface for sites, and earlier than 4.0.7 versions fail to enforce project membership constraints on API endpoints. Site administrators should examine whether the plugin version 4.0.7 or higher is installed; earlier releases are considered affected.

Because the plugin's REST API exposes sensitive data without restricting access, an attacker who can authenticate to the WordPress site – which is achievable with typical subscriber credentials – can retrieve private email addresses and task details across projects. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the path to exploitation is straightforward: a simple HTTP request to the vulnerable endpoint returns the data. The absence of a CVSS score means the quantitative severity is undefined, yet the potential confidentiality impact and the ability to tamper with project data grant this issue considerable risk for affected sites.