The Project Manager WordPress Plugin: Unauthenticated Remote Code Execution (CVE-2026-116512)
The Project Manager - AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress contains a remote code execution vulnerability in versions up to and including 4.1.1.
CVE search metadata
CVE search record: CVE-2026-116512. Severity: critical. CVSS: 9.8. EPSS: 0.58%. KEV: no. Product: Project Manager (<= 4.1.1). Brief: The Project Manager WordPress Plugin: Unauthenticated Remote Code Execution (CVE-2026-116512). Brief link: https://feed.craftedsignal.io/briefs/2026-10-the-project-manager-rce/
Triage facts
Revision 2- Applicability
- Project Manager (<= 4.1.1)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 3, 14:11 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: affected_products, affected_vendors, claim_state, cpes, cves, has_poc, lastmod, poc_references, references, updates
Sources: 1
The vulnerability exists in the 'id' parameter, where unsanitized input is concatenated into a pipe-delimited validation rule string. This string is split and each token is invoked as a dynamic PHP function without an allowlist. Because the validation occurs via the WordPress REST API before the permission check, unauthenticated attackers can execute arbitrary code on the server.