SQL Injection Flaw in WP Project Manager Plugin for WordPress
CVE-2025-8994
6.5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 15 November 2025
What is CVE-2025-8994?
The WP Project Manager plugin for WordPress exhibits a time-based SQL Injection vulnerability via the 'completed_at_operator' parameter across all versions up to and including 2.6.26. This flaw arises from inadequate escaping of user-supplied input and insufficient preparation of SQL queries, enabling authenticated users with Subscriber-level access or higher to inject malicious SQL queries into existing operations, potentially revealing sensitive database information.
Affected Version(s)
Project Management & Task Manager with Kanban Board & Gantt Chart – WP Project Manager * <= 2.6.26