WP Project Manager vulnerabilities

Unauthenticated PHP Object Injection in WP Project Manager versions up to 4.0.6.

Broken Access Control vulnerability in WP Project Manager up to version 4.0.7 allows a subscriber to gain unauthorized access to administrative functions.

The WP Project Manager plugin by weDevs is vulnerable to insertion of sensitive information into sent data, allowing retrieval of embedded sensitive data. The issue affects versions up to and including 3.0.1.

The WP Project Manager plugin for WordPress is vulnerable to time-based SQL Injection via the 'completed_at_operator' parameter in all versions up to and including 2.6.26. This is due to insufficient escaping and lack of query preparation, allowing authenticated attackers with Subscriber-level access and above to append additional SQL queries and extract sensitive information from the database.

The WP Project Manager plugin for WordPress contains a vulnerability involving the use of hard-coded credentials, allowing an attacker to retrieve sensitive data embedded in the application. The issue affects versions up to and including 2.6.25.