Security Alert Summary
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker WordPress plugin contains a vulnerability that allows unauthenticated remote code execution via the id parameter. The issue arises from an unsanitized value being concatenated into a pipe-delimited validation rule string, which is then split and invoked as dynamic PHP functions without an allowlist check. On the vulnerable code path, the validate_callback is executed by WP_REST_Server::dispatch() before the route permission_callback runs, allowing attackers to bypass the Project_Manage_Capability authorization gate.
CVE Details
- CVE ID:
CVE-2026-116512 - Affected component: Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker (plugin)
- Affected versions: All versions up to and including 4.1.1
- Published: October 31, 2026 at 8:16:48 AM
- Last modified: October 31, 2026 at 8:16:48 AM
- CVSS v3.1: Base Score 9.8, Severity: CRITICAL, Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Authentication / Privileges / User interaction: No authentication required; privileges required: none; user interaction: none
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness (CWE): CWE-434
Technical Details
The plugin accepts an id parameter whose value is concatenated directly into a pipe-delimited validation rule string. That string is split into tokens and each token is invoked as a dynamic PHP function without any allowlist or sanitization. Because the validate_callback for the REST route is executed inside WP_REST_Server::dispatch() before the route’s permission_callback, the usual authorization gate (Project_Manage_Capability) is not reached on this code path. As a result, unauthenticated requests can trigger dynamic function calls derived from attacker-controlled input, enabling remote code execution on the server.
Named elements from the report include the id parameter, the dynamic invocation of validation tokens as PHP functions, and the interaction with WP_REST_Server::dispatch() that allows bypass of the Project_Manage_Capability check. The root cause is a lack of input sanitization and absence of an allowlist when invoking dynamic functions.
How This Could Impact Your Website
Consider a small team using this plugin: the site owner installs the plugin, editors and contributors manage projects, and an external contractor integrates data via the REST API. An unauthenticated attacker exploiting this vulnerability could execute code on the server, which may lead to unauthorized access to site data, modification of project content, or disruption of services.
Practical consequences include exposure of internal user email addresses and other sensitive project data, which increases the risk of targeted phishing or social engineering against staff and contractors. The attack vector does not require an existing user session, so even external integrations can be leveraged.
If you re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and editor roles.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and logs for unusual behavior, such as unexpected REST API calls or new files on the server.
If you d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/core/Router/WP_Router.php#L429
- https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/core/Validator/Abstract_Validator.php#L156
- https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/src/Project/Validators/Update_Project.php#L25
- https://plugins.trac.wordpress.org/changeset/3772103/wedevs-project-manager/trunk/core/Validator/Abstract_Validator.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d3e300b3-39cc-4681-a8e8-02d9743f97ff?source=cve
