Unauthenticated Account Creation via Missing Authorization Checks

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Project Manager WordPress plugin before version 4.0.7 contains a critical authorization bypass vulnerability in its import routes that allows unauthenticated attackers to create WordPress user accounts with predetermined credentials. This vulnerability is particularly dangerous because it completely circumvents WordPress's built-in registration controls and site administrator settings, enabling attackers to gain persistent authenticated access to compromised installations. Any WordPress site running the affected plugin version is at risk, regardless of whether user registration is enabled or disabled by the site administrator. The attacker gains the ability to establish legitimate-looking user accounts that blend in with normal site activity, making detection significantly more difficult.

Casky's 283 mapped security skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability by monitoring for MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky will observe findings that correlate suspicious patterns such as: unexpected user account creation events without corresponding registration requests, POST requests to the Project Manager plugin's import endpoints originating from unauthenticated sessions, and new WordPress user accounts appearing with unusually high privilege levels or created outside normal registration workflows. The platform's skill set would flag CWE-862 (Missing Authorization) violations by identifying HTTP requests to protected administrative functions that lack proper capability checks, allowing security teams to pinpoint precisely which requests bypassed authorization controls and trace them back to their origins for incident response and forensic analysis.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-74928.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-74928

Casky has 283 skills that investigate the attack patterns behind CVE-2026-74928. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn