CVE-2026-116512: Project Manager Plugin RCE (9.8)

A critical vulnerability, tracked as CVE-2026-116512, affects the WordPress plugin "Project Manager - AI Powered Project Management, Task Management, Kanban Board & Time Tracker". According to the GitHub Advisory, all versions up to and including 4.1.1 are vulnerable to remote code execution by unauthenticated attackers. It carries a CVSS score of 9.8.

If your site, or a client's site, runs this plugin, treat it as urgent. At the time of writing the public record does not state a patched version, so the first job is to find out whether you have the plugin at all and then reduce your exposure while you confirm what the vendor has released.

What happened

The vulnerability was published on October 31, 2026 by the National Vulnerability Database and the GitHub Advisory Database. The description says the plugin is vulnerable to remote code execution through the 'id' parameter, and that no login is needed to reach the vulnerable code. The NVD entry repeats the same text as the GitHub advisory, so it is the same report and not a second confirmation.

Only one independent publisher covers this story so far, and the advisory is marked as unreviewed by GitHub. Treat details beyond the published description as unconfirmed.

How the flaw works

The advisory describes the problem in plain code terms. The plugin builds a validation rule as a text string with rules separated by pipe characters. The value of the 'id' parameter is added to that string without being cleaned. The string is later split apart, and each piece is then called as a PHP function by name, with no allowlist of permitted functions. In effect, a request can influence which PHP functions the server runs.

This weakness class is often described as unsafe dynamic function invocation: when user-supplied text decides which code runs, the person sending the text can choose the code. That is why the impact is rated high for confidentiality, integrity and availability.

Why the login check does not help

The advisory also explains why attackers do not need an account. WordPress core runs a route argument's validate_callback inside WP_REST_Server::dispatch() before it runs the route's permission_callback. The plugin's capability gate, named Project_Manage_Capability, sits in the permission step, so on the vulnerable path it is never reached. Validation runs first, and the dangerous code lives in validation.

Who is affected

Any WordPress site with this plugin active at version 4.1.1 or earlier is in scope. The plugin's directory slug appears in the advisory's source links as wedevs-project-manager. Because the flaw needs no account, the usual defenses of closed registration or strong passwords do not apply. Agencies and hosts that manage many sites should assume some of them run this plugin for client project tracking.

The research does not say how many sites use the plugin, and it does not report attacks in the wild. Absence of reports is not proof of safety, particularly for a flaw this easy to reach.

How to check your exposure

1. Log in to wp-admin and open the Plugins page. Look for "Project Manager" with the Kanban Board and Time Tracker description, and note the installed version.
2. If you manage servers, check the plugins directory on disk for a folder named wedevs-project-manager, including on staging copies and old backups that are web-accessible.
3. If the version is 4.1.1 or lower, consider the site vulnerable until you have confirmed a newer release from the vendor.
4. Check the plugin's page in the WordPress.org directory and its changelog for a release newer than 4.1.1 that mentions this issue. The research did not confirm one, so verify it yourself.
5. Review the known vulnerabilities per WordPress plugin page for updates on this plugin.

What to do now

The Trac changeset for the validator file is linked from the advisory and suggests a code change was made on the development trunk. The research does not confirm that it is a fix or that it has shipped in a tagged release, so do not rely on it. Take these steps in order.

1. Back up the site and database first, so you can recover if something goes wrong later.
2. If a newer plugin version than 4.1.1 is available and its changelog addresses this issue, update right away, then test project and task pages.
3. If no fixed version is available, deactivate and delete the plugin until one is. A deactivated plugin's code can still sit on disk, so deleting it is safer than leaving it inactive.
4. If you cannot remove it because the team depends on it, restrict access with a web application firewall rule or server rule that blocks requests to the plugin's REST routes from untrusted visitors. Test carefully so you do not break legitimate use. See what a WAF is for background.
5. Rotate secrets that PHP could read if you suspect exposure: database password, WordPress salts and keys, API keys stored in wp-config.php or plugin settings, and admin passwords.
6. Keep the plugin list lean. Remove other plugins you do not use, and follow the WordPress security checklist.

Detection and monitoring

Remote code execution means a successful attacker could run arbitrary code with the web server's permissions, so look for the usual aftermath rather than a specific signature. Nothing in the research describes exploit traffic, so these are general checks.

• Unexpected new administrator accounts, or changes to existing users' email addresses.
• New or recently modified PHP files in wp-content, especially in uploads, plugin and theme folders, or files with random-looking names.
• Web server logs showing unusual requests to the site's REST API paths (those beginning with /wp-json/) that include the project-related routes, particularly from a single address or with odd 'id' values.
• Unfamiliar scheduled tasks (cron events), outbound connections from the server, or sudden spikes in CPU use.
• Modified core files. Compare them against a clean WordPress copy using WP-CLI's checksum command.

A read-only outside scan can help spot some signs of compromise, such as injected scripts or spam content, though it cannot see everything on the server. Read about what outside-in malware detection can and cannot see, or run the free website malware scanner. If you find signs of a break-in, follow website hacked: what to do.

What we still do not know

• Which version fixes the issue, if one exists yet. The advisory lists patched versions as unknown.
• Whether attackers are exploiting it. The research reports no exploitation and no CISA KEV listing as of October 31, 2026.
• Whether a public proof of concept exists. None is mentioned in the research, and this article does not describe exploitation steps.
• The reason for the CWE-434 label, given that the description does not mention uploads.

We will not guess at any of these. Check the plugin's official changelog and the Wordfence entry referenced by the advisory for updates.

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

• CVE-2026-116512 - GitHub Advisory Database (github.com)
• CVE-2026-116512: The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution… (nvd.nist.gov, 31 October 2026)

Tags: WordPress, CVE-2026-116512, RCE, plugin security, REST API