The WP Project Manager plugin contains an Insecure Direct Object Reference flaw: a REST API route that returns a user's activity history does not check that the requester is the same as the target. An authenticated user, including those with the Subscriber role, can therefore fetch another user's activity log, email address, and project details they are not entitled to see. This exposure allows sensitive data disclosure and may facilitate further social engineering or unauthorized context. The weakness aligns with CWE-284 (Improper Access Control) and CWE-639 (Information Exposure via IDOR).

The vulnerability affects the WordPress plugin WP Project Manager versions 2.2.0 through 4.0.6 inclusive. Any WordPress site running the plugin in these versions is at risk.

The flaw is not listed in CISA’s KEV catalog and no EPSS score is available, indicating limited publicly known exploitation data. However, any authenticated user can trigger the flaw via the exposed REST endpoint, so the impact is confined to users of the site. Because the attacker only needs an existing account, the risk of disclosure is significant within the user community, but broader widespread exploitation would require site compromises that allow credential reuse or game with multiple accounts.