WP Project Manager Missing Authorization Vulnerability Allowing Denial-of-Service

A vulnerability exists in the WP Project Manager plugin for WordPress, specifically in versions through 2.6.17. The issue arises from a missing capability check in the '/pm/v2/settings/notice' endpoint, which allows authenticated attackers with Subscriber-level access and above to manipulate options arbitrarily. This could lead to unauthorized data loss and the creation of a persistent denial-of-service condition.

Impact

Exploitation of this vulnerability can cause a persistent denial-of-service condition on the affected WordPress site.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access or higher can send a request to the '/pm/v2/settings/notice' endpoint without the necessary authorization. This can be done by omitting the required capability checks, which are not enforced in the current plugin version.

Remediation

Users are advised to update the WP Project Manager plugin to version 2.6.18 or later, where this vulnerability has been patched.