{"id":"CVE-2026-116512","published":"2026-10-31T08:16:48.603","lastModified":"2026-10-31T08:16:48.603","description":"The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP function with no allowlist check. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable by unauthenticated attackers because WordPress core executes the route argument's validate_callback inside WP_REST_Server::dispatch() before the route's permission_callback is invoked, meaning the Project_Manage_Capability authorization gate is never reached on the vulnerable code path.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/core/Router/WP_Router.php#L429","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/core/Validator/Abstract_Validator.php#L156","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/src/Project/Validators/Update_Project.php#L25","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3772103/wedevs-project-manager/trunk/core/Validator/Abstract_Validator.php","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3e300b3-39cc-4681-a8e8-02d9743f97ff?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Project Manager WordPress plugin (up to v4.1.1) contains a Remote Code Execution vulnerability where an unsanitized 'id' parameter is concatenated into a pipe-delimited validation rule string and executed as dynamic PHP functions without an allowlist, allowing unauthenticated attackers to run arbitrary code on the server.","exploitability":"Exploitation is trivial for unauthenticated attackers due to the lack of authentication or authorization checks before the vulnerable validation callback executes in WordPress REST API routing.","blast_radius":"Successful exploitation grants full server compromise (RCE), enabling data theft, malware deployment, or lateral movement within the hosting environment.","remediation":"Upgrade to Project Manager plugin version 4.1.2 or later, which patches the unsanitized 'id' parameter handling and adds proper allowlist validation for callback functions.","detection":"Look for HTTP requests to REST API endpoints (e.g., /wp-json/) containing suspicious pipe-delimited strings in the 'id' parameter that resolve to non-standard PHP functions or class methods, especially when paired with unexpected HTTP status codes like 200 instead of 401/403 on protected routes.","tags":["rce","rest-api","unsanitized-input","auth-bypass","wordpress","dynamic-function-call"],"model":"garnet-coder","analyzedAt":"2026-10-31T08:48:01.995Z"}}