Remote Code Execution Vulnerability in Project Manager Plugin for WordPress
CVE-2026-116512

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Project Manager – Ai Powered Project Management, Task Management, Kanban Board & Time Tracker
Vendor
CVE Published:
31 October 2026

What is CVE-2026-116512?

The Project Manager plugin for WordPress has a critical vulnerability that allows unauthenticated users to execute arbitrary code on the server. This flaw arises from the unsanitized handling of the 'id' parameter, which is directly concatenated into a validation rule string. This dangerous operation enables attackers to bypass validation checks and invoke dynamic PHP functions without any authorization, exposing systems to significant risks. The vulnerability affects all versions of the Project Manager plugin up to 4.1.1, making it critical for users to update to secure versions and mitigate the risks associated with this security flaw.

Affected Version(s)

Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker 0 <= 4.1.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wedevs-project...
https://plugins.trac.wordpress.org/browser/wedevs-project...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Osman Hussein
.