# Projectopia – WordPress Project Management <= 5.1.25.2 - Unauthenticated Privilege Escalation via Account Takeover through Client Profile and Contact Editing

- **ID:** WPSEC-2026-1955
- **Plugin:** Projectopia – Project Management Tool (`projectopia-core`), https://wordpress.org/plugins/projectopia-core/
- **Affected versions:** all versions before 5.1.26
- **Fixed in:** 5.1.26 (Update to 5.1.26 or later.)
- **Severity:** Critical 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/projectopia-core
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1955/

## Description

The Projectopia plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.25.2. This is due to missing authorization checks in the pto_client_update_details, pto_client_add_contact and pto_edit_client_contact AJAX actions. These actions were registered for unauthenticated users and were protected only by a nonce that is printed on the public registration, quote and lead form pages. pto_client_update_details updated the email address of any user ID supplied in the request. pto_edit_client_contact set the password of any client's contact account and then issued a login cookie for that account. pto_client_add_contact created client-role accounts on any client record. This makes it possible for unauthenticated attackers to change the email address of any account, including administrators, and then reset its password. Attackers can also set the passwords of client contacts and log in as them, or attach new client users to any client.

## References

- https://wpsec.com/vuln/WPSEC-2026-1955/
- https://plugins.svn.wordpress.org/projectopia-core/tags/5.1.26/
- https://wordpress.org/plugins/projectopia-core/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1955/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.