{
 "id": "WPSEC-2026-1953",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1953/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1953/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1953/index.md",
 "title": "Projectopia – WordPress Project Management <= 5.1.25.2 - Unauthenticated Missing Authorization to Arbitrary User Deletion via Client Contact Removal",
 "description": "The Projectopia plugin for WordPress is vulnerable to unauthorized user deletion via the pto_remove_client_contact AJAX action in all versions up to, and including, 5.1.25.2. This is due to a missing capability and ownership check, and to the handler not confirming that the target account is an ordinary contact. The action was registered for unauthenticated users and was protected only by a nonce that is printed on public form pages. This makes it possible for unauthenticated attackers to delete the WordPress accounts listed as contacts on any client record.",
 "plugin": {
  "slug": "projectopia-core",
  "name": "Projectopia – WordPress Project Management",
  "full_name": "Projectopia – Project Management Tool",
  "wordpress_org": "https://wordpress.org/plugins/projectopia-core/",
  "advisories_url": "https://wpsec.com/vuln/plugin/projectopia-core/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/projectopia-core"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.1.26",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.1.26"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.1.26",
 "remediation": "Update to 5.1.26 or later.",
 "fix_released": "2026-10-28T07:47:04+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:47:15.892122+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1953/",
  "https://plugins.svn.wordpress.org/projectopia-core/tags/5.1.26/",
  "https://wordpress.org/plugins/projectopia-core/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/projectopia-core",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-29"
 }
}