Unauthenticated remote code execution PoC published for WordPress Project Manager plugin
The weDevs Project Manager plugin for WordPress allows unauthenticated remote code execution in all versions up to and including 4.1.1, according to Patchstack. A proof of concept has been disclosed and the source mentions no available fix. Users should restrict or disable the plugin until an update is released.
What happened
A flaw in the weDevs Project Manager plugin for WordPress lets attackers run code on the server without any account or password. It affects all versions up to 4.1.1, and Patchstack has disclosed a proof of concept.
Why it matters
An attacker can take over the site, steal stored data or deface pages without a valid user account. Company websites running this project management plugin are directly exposed on the internet.
What to do
Check today whether any site runs the weDevs Project Manager plugin at version 4.1.1 or earlier. With no fix mentioned in the source, disable the plugin or restrict access. Update as soon as a new version is released.
For the technical team
- CVE
- CVE-2026-116512
- Affected
- weDevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker (plugin WordPress) · Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker (weDevs, WordPress): all versions up to, and including, 4.1.1.
- Exploitation
- PoC/exploit published and cataloged by Patchstack (PT ID PT-2026-134475). The source reports no in-the-wild exploitation.
- Fix
- The source mentions no fixed version, patch or mitigation.
- Vector
- WeDevs Project Manager WordPress plugin, CVE-2026-116512. The unsanitized 'id' parameter value is concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP function with no allowlist check. Exploitable by unauthenticated attackers: WordPress core executes the route argument's validate_callback inside WP_REST_Server::dispatch before the route's permission_callback, so the Project_Manage_Capability authorization gate is never reached on the vulnerable code path. No login required.
- More details
- Root cause lies in WordPress REST execution order: argument validation runs before the route permission check, turning a validation flaw into unauthenticated code execution. Technical description published by Patchstack.
Timeline
Patchstack discloses RCE PoC (CVE-2026-116512) for Project Manager plugin up to version 4.1.1.
Sources 1 source
- @ptdbugs @ptdbugs
