CVE-2025-49974

This vulnerability resides in the UpStream Project Management Plugin for WordPress, affecting versions 2.1.1 and earlier. The root cause is a missing authorization check (broken access control) in one or more plugin functions, meaning the code fails to verify that the current user has the required permissions before executing a privileged action [1].

An attacker needs no special authentication; any unauthenticated or low-privileged user who can interact with the plugin's endpoints can exploit this gap. By sending crafted requests to the vulnerable function, they can bypass intended access restrictions. Such flaws are often targeted in mass-exploit campaigns affecting thousands of sites simultaneously [1].

Successful exploitation lets an attacker perform actions normally restricted to higher-privileged roles, such as administrators. Depending on the misconfigured function, this could include modifying project data, altering settings, or other unauthorized operations inside the plugin.

At the time of publication, no patched version has been released. Users are strongly urged to update the plugin immediately and, if unable to do so, seek assistance from their hosting provider or web developer. No workaround is mentioned beyond updating [1].