Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker <= 4.1.1 - Authenticated (Subscriber+) Remote Code Execution via Project 'id' Parameter
- ID
- WPSEC-2026-1993
- Plugin
- Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker (wedevs-project-manager)
- Affected
- all versions before 4.1.2
- Remediation
- Update to 4.1.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-94
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker on WPSec AttackSurface
- Fix released
- Published
Description
The Project Manager plugin for WordPress is vulnerable to Remote Code Execution via the project 'id' parameter in all versions up to, and including, 4.1.1. This is due to the project update validator concatenating the unsanitized request id into its validation rule string, and the validator calling any PHP function named in a rule when no matching prefixed validator exists. This makes it possible for authenticated attackers who are allowed to update a project, which can include low-privileged users such as subscribers who have been given access to a project, to inject additional rules that call arbitrary PHP functions such as system(), leading to code execution on the server.
References
- https://wpsec.com/vuln/WPSEC-2026-1993/
- https://plugins.svn.wordpress.org/wedevs-project-manager/tags/4.1.2/
- https://wordpress.org/plugins/wedevs-project-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS