Project Manager plugin: Unauthenticated remote code execution
Summary
The WordPress plugin Project Manager (wedevs-project-manager) by weDevs does not sanitize the 'id' parameter. The value is concatenated into a validation rule that is split and invoked as PHP functions without an allowlist check. An unauthenticated remote attacker can execute code on the server if the plugin is installed and active. According to the description, the vulnerable code path runs before the plugin's permission check.
Affected
- Project Manager plugin for WordPress (wedevs-project-manager), versions 0 up to and including 4.1.1
Fixed in
Unknown. No vendor advisory or patched version has been confirmed.
Workaround
- No vendor workaround published.
- Deactivate and remove the plugin until a fixed version is confirmed.
- Check whether your WAF or virtual patching service has a rule for this CVE.
Exploitation
Unknown. No evidence of active exploitation or a public proof of concept was found at the time of writing. No CISA KEV entry was found. The CVE is very recent, so this may change.
Our recommendation
- Identify all WordPress sites with this plugin, including staging sites and inactive installations.
- Deactivate and remove the plugin where it is not essential.
- Monitor Wordfence and the vendor for a fixed release and apply it immediately.
- Review web server logs for unusual requests with an 'id' parameter to the plugin's REST routes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence record www.wordfence.com
- WordPress.org plugin listing wordpress.org
- Trac changeset 3772103 (Abstract_Validator.php) plugins.trac.wordpress.org
- Trac 4.1.1 Abstract_Validator.php plugins.trac.wordpress.org
- Trac 4.1.1 WP_Router.php plugins.trac.wordpress.org
- GitHub pull request 698 (release 4.1.1) github.com
- GitHub release v4.0.7 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:21.
Original description (NVD)
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP function with no allowlist check. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable by unauthenticated attackers because WordPress core executes the route argument's validate_callback inside WP_REST_Server::dispatch() before the route's permission_callback is invoked, meaning the Project_Manage_Capability authorization gate is never reached on the vulnerable code path.
NVD references (5)
- https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/core/Router/WP_Router.php#L429
- https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/core/Validator/Abstract_Validato…
- https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/src/Project/Validators/Update_Pr…
- https://plugins.trac.wordpress.org/changeset/3772103/wedevs-project-manager/trunk/core/Validator/Abstract_Val…
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d3e300b3-39cc-4681-a8e8-02d9743f97ff?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.