# Projectopia – WordPress Project Management <= 5.1.25.2 - Unauthenticated Missing Authorization to Task Creation, Contract Email Sending and Client Alert Clearing

- **ID:** WPSEC-2026-1954
- **Plugin:** Projectopia – Project Management Tool (`projectopia-core`), https://wordpress.org/plugins/projectopia-core/
- **Affected versions:** all versions before 5.1.26
- **Fixed in:** 5.1.26 (Update to 5.1.26 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/projectopia-core
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1954/

## Description

The Projectopia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 5.1.25.2. This is due to missing capability checks on the pto_create_task, pto_filter_tasks, pto_process_contract_emails and pto_clear_client_alert AJAX actions. These actions were registered for unauthenticated users and were protected only by a nonce that is printed on public form pages. This makes it possible for unauthenticated attackers to create tasks, change the stored task status filter, trigger contract emails for any project, and clear alerts on any client record.

## References

- https://wpsec.com/vuln/WPSEC-2026-1954/
- https://plugins.svn.wordpress.org/projectopia-core/tags/5.1.26/
- https://wordpress.org/plugins/projectopia-core/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1954/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.