Cpe:2.3:a:wedevs:project_manager:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3awedevsproject_manager/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 09:54:08 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgThe Project Manager WordPress Plugin: Unauthenticated Remote Code Execution (CVE-2026-116512)https://feed.craftedsignal.io/briefs/2026-10-the-project-manager-rce/Sat, 31 Oct 2026 09:54:08 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-the-project-manager-rce/The Project Manager - AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress contains a remote code execution vulnerability in versions up to and including 4.1.1.<p>The vulnerability exists in the 'id' parameter, where unsanitized input is concatenated into a pipe-delimited validation rule string. This string is split and each token is invoked as a dynamic PHP function without an allowlist. Because the validation occurs via the WordPress REST API before the permission check, unauthenticated attackers can execute arbitrary code on the server.</p> criticaladvisory