CVE-2023-3636

Name of the Vulnerable Software and Affected Versions WP Project Manager plugin for WordPress versions up to, and including, 2.6.4

Description The issue allows authenticated attackers with minimal permissions, such as a subscriber, to modify their user role. This is possible due to insufficient restriction on the save users map name function, which can be exploited by supplying the usernames parameter.

Recommendations For WP Project Manager plugin for WordPress versions up to, and including, 2.6.4, consider disabling the save users map name function until a patch is available to prevent privilege escalation. Restrict access to the usernames parameter in the affected function to minimize the risk of exploitation.