CVE-2026-116512: WordPress Project Manager Plugin — Critical Unauthenticated Remote Code Execution

Executive Summary

A critical remote code execution vulnerability has been disclosed in the Project Manager WordPress plugin (AI Powered Project Management, Task Management, Kanban Board & Time Tracker, by weDevs). Tracked as CVE-2026-116512 with a CVSS 3.1 score of 9.8, the flaw affects all versions up to and including 4.1.1.

The plugin does not sanitize the id request parameter. Its value is concatenated into a pipe-delimited validation rule string, which is later split and each token is executed as a PHP function with no allowlist. Because WordPress core runs a REST route's validate_callback before its permission_callback, the vulnerable code is reachable by unauthenticated attackers.

CVSS Score: 9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Overview

NVD lists the weakness as CWE-434, although the described behavior (dynamic function invocation from user input) does not obviously match that class. The record was still in "Received" status at the time of writing, so classification may change.

Root Cause

The plugin's request validator builds a rule string from request parameters, including id. The string is split on the pipe character and each resulting token is treated as a validation rule name and invoked as a PHP function. An attacker who controls the id value can therefore inject extra tokens that name arbitrary callable PHP functions. Since route validation runs before permission checks in WordPress core, no login is needed.

The reference code paths are in core/Router/WP_Router.php, core/Validator/Abstract_Validator.php, and src/Project/Validators/Update_Project.php. A fix has been committed to the plugin's trunk in Abstract_Validator.php.

Impact

Successful exploitation can give an attacker code execution in the context of the web server user, enabling:

• Full site takeover, including creation of rogue administrator accounts
• Web shell or backdoor installation
• Theft of wp-config.php secrets and database credentials
• Pivoting to other sites sharing the same host

I could not confirm public exploit code or in-the-wild exploitation at the time of writing. WordPress plugin RCEs with no authentication requirement are routinely mass-scanned shortly after disclosure, so treat this as urgent.

Remediation

Immediate Steps

1. Update Project Manager to the latest release above 4.1.1 as soon as it is available from the WordPress.org repository
2. If no fixed version is available for your site: deactivate and remove the plugin
3. Audit the site for unexpected PHP files, new admin users, and modified core or plugin files
4. Rotate database credentials and WordPress salts if compromise is suspected

Hardening

• Deploy a WAF rule that inspects the id parameter on the plugin's REST routes for pipe characters and function names
• Restrict PHP execution in upload directories
• Run the web server user with minimal filesystem and outbound network permissions
• Enable file integrity monitoring on the WordPress install

Detection

Key Takeaways

1. CVSS 9.8 Critical — unauthenticated RCE with no user interaction
2. All versions up to 4.1.1 are affected
3. The bug is a validation-before-authorization ordering issue in WordPress REST routing combined with unsafe dynamic function calls
4. Remove or update the plugin immediately and review the site for signs of compromise

References

• NVD — CVE-2026-116512
• Wordfence Threat Intelligence entry
• Plugin source — Abstract_Validator.php fix changeset