CVE-2026-116512
Received Received - Intake

Remote Code Execution in Project Manager AI Powered Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP function with no allowlist check. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable by unauthenticated attackers because WordPress core executes the route argument's validate_callback inside WP_REST_Server::dispatch() before the route's permission_callback is invoked, meaning the Project_Manage_Capability authorization gate is never reached on the vulnerable code path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-116512
EUVD
EUVD-2026-114653

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Remote Code Execution flaw in the Project Manager WordPress plugin up to version 4.1.1. It occurs because the 'id' parameter is not properly sanitized and is directly concatenated into a pipe-delimited validation rule string. This string is then split and each part is executed as a PHP function without any allowlist check, allowing unauthenticated attackers to run arbitrary code on the server.

Detection Guidance

Check for unauthorized code execution attempts or suspicious activity in server logs. Look for POST requests to WordPress REST API endpoints with the 'id' parameter containing PHP functions or shell commands. Use tools like grep to search logs for patterns like 'eval(', 'system(', or 'passthru('.

Impact Analysis

If you use the affected plugin, attackers could exploit this to take full control of your WordPress site, steal data, install malware, or disrupt services. Since it requires no authentication, any unauthenticated user can potentially compromise your site.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. A successful exploit may result in data breaches, triggering legal penalties and compliance violations.

Mitigation Strategies

Immediately update the Project Manager plugin to the latest version if available. If no update exists, disable or uninstall the plugin immediately. Review server logs for signs of exploitation and remove any unauthorized files or backdoors. Consider implementing a web application firewall to block malicious requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116512. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart