CVE-2023-3636: 
WordPress vulnerability analysis and mitigation

The WP Project Manager plugin for WordPress contains a privilege escalation vulnerability (CVE-2023-3636) affecting versions up to and including 2.6.4. The vulnerability was discovered in July 2023 and publicly disclosed on August 31, 2023. The issue exists in the 'saveusersmap_name' function due to insufficient authorization checks (NVD, WPScan).

The vulnerability stems from improper authorization checks in the 'saveusersmap_name' function, which allows authenticated users with minimal permissions to modify their user role by manipulating the 'usernames' parameter. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Wordfence).

The vulnerability allows authenticated attackers with minimal privileges, such as subscribers, to elevate their privileges to administrator level, potentially gaining full control over the WordPress site (WPScan).

The vulnerability has been patched in version 2.6.5 of the WP Project Manager plugin. Site administrators are strongly advised to update to this version or later to protect against potential exploitation (WPScan).