Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Project Manager plugin lets attackers run code on server

CVE-2026-116512 · published today
Summary

The Project Manager – AI Powered Project Management plugin for WordPress can let anyone on the internet run their own code on your server. This happens because the plugin does not check the 'id' value it receives before using it to call functions, bypassing the normal permission check. Update the plugin to a version that fixes this or remove it until a safe update is available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
wedevs project manager – ai powered project management, task management, kanban board & time tracker <= 4.1.1
Original advisory text
Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP function with no allowlist check. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable by unauthenticated attackers because WordPress core executes the route argument's validate_callback inside WP_REST_Server::dispatch() before the route's permission_callback is invoked, meaning the Project_Manage_Capability authorization gate is never reached on the vulnerable code path.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Type
CWE-434Unrestricted File Upload
Timeline
Published31 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CVE-2026-116512 · NVD
CVE-2026-116512 · MITRE
Track software like this
Free during beta