An unauthenticated attacker can run code on servers running weDevs' Project Manager plugin for WordPress, version 4.1.1 or earlier, by sending a crafted id parameter to a REST route.
What Is It
CVE-2026-116512 is a remote code execution flaw in the "Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker" plugin for WordPress. Wordfence reported it.
The plugin takes the value of the id parameter without sanitizing it and pastes it straight into a validation rule string separated by pipe (|) characters. The plugin then splits that string and calls each piece as a PHP function. No allowlist limits which functions can be called, so an attacker who controls id can choose which PHP functions run on the server.
Why It Matters
No login is needed to reach this flaw. WordPress core runs a route argument's validate_callback inside WP_REST_Server::dispatch() before it runs the route's permission_callback. The vulnerable code sits in the validation step, so the plugin's Project_Manage_Capability permission check never runs.
Wordfence scores the flaw 9.8 (Critical) under CVSS 3.1, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms:
- it can be attacked over the network
- the attack is simple
- no account or user interaction is needed
- confidentiality, integrity and availability impact are all high
The NVD record lists the weakness as CWE-434 (Unrestricted Upload of File with Dangerous Type). That label does not fit the flaw described here. No file upload is involved: attacker input decides which PHP functions the plugin calls, which is a code injection problem.
Exploitation status: CVE-2026-116512 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. KEV does not confirm active exploitation at this time.
What's Vulnerable
- Vendor: wedevs
- Product: Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker (WordPress plugin, slug
wedevs-project-manager) - Affected versions: all versions up to and including 4.1.1
The vulnerable code path runs through the plugin's router (core/Router/WP_Router.php), its validator (core/Validator/Abstract_Validator.php) and the project update validator (src/Project/Validators/Update_Project.php).
Patch Status
The supplied data does not name a fixed version. The NVD record links to a change to Abstract_Validator.php in the plugin's development code (WordPress Trac changeset 3772103), which suggests a code fix exists. Without a confirmed patched release:
- Admins should check for a plugin release newer than 4.1.1 that includes this change, and update to it.
- If no fixed release is available yet, consider deactivating the plugin on sites exposed to the internet.
No CISA required action applies, because the CVE is not listed in the KEV catalog.
Sources
- NVD – CVE-2026-116512
- Wordfence Threat Intel advisory
- CISA Known Exploited Vulnerabilities Catalog
- WordPress Developer Reference – WP_REST_Server::dispatch()
- WordPress Trac – WP_Router.php (4.1.1)
- WordPress Trac – Abstract_Validator.php (4.1.1)
- WordPress Trac – Update_Project.php (4.1.1)
- WordPress Trac – Changeset 3772103