CVE-2026-116512Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker Unrestricted File Upload
Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
Published Oct 31, 2026 · Updated Oct 31, 2026 · Also known as EUVD-2026-114653, GHSA-3j45-2638-6g5h, WORDFENCE-d3e300b3-39cc-4681-a8e8-02d9743f97ff, d3e300b3-39cc-4681-a8e8-02d9743f97ff
Key Facts
Patch immediately- CVE-2026-116512 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting wedevs-project-manager (wordpress-plugin), Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker.
- It is exploited in the wild, listed in Industry KEV feed since Oct 30, 2026. No public exploit code is known.
- EPSS estimates a 0.6% probability of exploitation in the next 30 days.
- Fixed versions are available, including wedevs-project-manager 4.1.2.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
0.6%
Exploit maturity
Exploited (KEV)
ATLAS score
59/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Oct 30, 2026
-1 days after publication
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Exploited (KEV)
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
1
Reports of active use
Description
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP function with no allowlist check.
This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable by unauthenticated attackers because WordPress core executes the route argument's validate_callback inside WP_REST_Server::dispatch() before the route's permission_callback is invoked, meaning the Project_Manage_Capability authorization gate is never reached on the vulnerable code path.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Oct 30, 2026 | n/a | Not reported |
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| wedevs-project-managerwordpress-plugin | See advisory | 4.1.2 |
| Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker | See advisory | n/a |
Patched Releases
wedevs-project-manager
4.1.2
Timeline
Added to Industry KEV feed
Oct 30, 2026
Publicly disclosed
Oct 31, 2026
Weakness Type
- CWE-434 Unrestricted Upload of File with Dangerous Type
References
- advisorywordfence.com · d3e300b3-39cc-4681-a8e8-02d9743f97ff
- advisorywordfence.com · d3e300b3-39cc-4681-a8e8-02d9743f97ff
- exploitVulnCheck exploitation report
- otherplugins.trac.wordpress.org · WP_Router.php
- otherplugins.trac.wordpress.org · Abstract_Validator.php
FAQ
Common Questions.
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter.
Affected: wedevs-project-manager (wordpress-plugin); Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Oct 30, 2026.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including wedevs-project-manager 4.1.2.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2026-116512 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo