{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/project-manager--4.1.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wedevs:project_manager:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-116512"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=015868AD-B5AF-5B19-8F72-0485181E44AE\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Project Manager (\u003c= 4.1.1)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["weDevs"],"content_html":"\u003cp\u003eThe vulnerability exists in the 'id' parameter, where unsanitized input is concatenated into a pipe-delimited validation rule string. This string is split and each token is invoked as a dynamic PHP function without an allowlist. Because the validation occurs via the WordPress REST API before the permission check, unauthenticated attackers can execute arbitrary code on the server.\u003c/p\u003e\n","date_modified":"2026-11-03T14:10:40Z","date_published":"2026-10-31T09:54:08Z","id":"https://feed.craftedsignal.io/briefs/2026-10-the-project-manager-rce/","summary":"The Project Manager - AI Powered Project Management, Task Management, Kanban Board \u0026 Time Tracker plugin for WordPress contains a remote code execution vulnerability in versions up to and including 4.1.1.","title":"The Project Manager WordPress Plugin: Unauthenticated Remote Code Execution (CVE-2026-116512)","url":"https://feed.craftedsignal.io/briefs/2026-10-the-project-manager-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Project Manager (\u003c= 4.1.1)","version":"https://jsonfeed.org/version/1.1"}