Projectopia – WordPress Project Management <= 5.1.25.2 - Unauthenticated Privilege Escalation via Account Takeover through Client Profile and Contact Editing
- ID
- WPSEC-2026-1955
- Plugin
- Projectopia – Project Management Tool (projectopia-core)
- Affected
- all versions before 5.1.26
- Remediation
- Update to 5.1.26 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-29
- Attack surface
- Projectopia – WordPress Project Management on WPSec AttackSurface
- Fix released
- Published
Description
The Projectopia plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.25.2. This is due to missing authorization checks in the pto_client_update_details, pto_client_add_contact and pto_edit_client_contact AJAX actions. These actions were registered for unauthenticated users and were protected only by a nonce that is printed on the public registration, quote and lead form pages. pto_client_update_details updated the email address of any user ID supplied in the request. pto_edit_client_contact set the password of any client's contact account and then issued a login cookie for that account. pto_client_add_contact created client-role accounts on any client record. This makes it possible for unauthenticated attackers to change the email address of any account, including administrators, and then reset its password. Attackers can also set the passwords of client contacts and log in as them, or attach new client users to any client.
References
- https://wpsec.com/vuln/WPSEC-2026-1955/
- https://plugins.svn.wordpress.org/projectopia-core/tags/5.1.26/
- https://wordpress.org/plugins/projectopia-core/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS