CVE-2025-68040
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The WP Project Manager plugin by weDevs is vulnerable to insertion of sensitive information into sent data, allowing retrieval of embedded sensitive data. The issue affects versions up to and including 3.0.1.
Risk Assessment
Sensitive data such as passwords or keys may be exposed in data sent to the client, potentially leading to security breaches and data leakage.
Recommendation
Update the WP Project Manager plugin to the latest patched version. Verify that sensitive data is not included in responses.
Other vulnerabilities in WP Project Manager
See all- CVE-2026-97281Medium
Broken Access Control vulnerability in WP Project Manager up to version 4.0.7 allows a subscriber to gain unauthorized access to administrative functions.
- CVE-2026-78262Critical
Unauthenticated PHP Object Injection in WP Project Manager versions up to 4.0.6.
- CVE-2025-58269Medium
The WP Project Manager plugin for WordPress contains a vulnerability involving the use of hard-coded credentials, allowing an attacker to retrieve sensitive data embedded in the application. The issue affects versions up to and including 2.6.25.
Original NVD description (English source)
Insertion of Sensitive Information Into Sent Data vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 3.0.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS