{
 "id": "WPSEC-2026-1993",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1993/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1993/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1993/index.md",
 "title": "Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker <= 4.1.1 - Authenticated (Subscriber+) Remote Code Execution via Project 'id' Parameter",
 "description": "The Project Manager plugin for WordPress is vulnerable to Remote Code Execution via the project 'id' parameter in all versions up to, and including, 4.1.1. This is due to the project update validator concatenating the unsanitized request id into its validation rule string, and the validator calling any PHP function named in a rule when no matching prefixed validator exists. This makes it possible for authenticated attackers who are allowed to update a project, which can include low-privileged users such as subscribers who have been given access to a project, to inject additional rules that call arbitrary PHP functions such as system(), leading to code execution on the server.",
 "plugin": {
  "slug": "wedevs-project-manager",
  "name": "Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker",
  "full_name": "Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker",
  "wordpress_org": "https://wordpress.org/plugins/wedevs-project-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wedevs-project-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wedevs-project-manager"
 },
 "type": "RCE",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.8,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.1.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.1.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.1.2",
 "remediation": "Update to 4.1.2 or later.",
 "fix_released": "2026-10-29T05:09:07+00:00",
 "published": "2026-10-30T05:43:34+00:00",
 "updated": "2026-10-29T17:43:45.011906+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1993/",
  "https://plugins.svn.wordpress.org/wedevs-project-manager/tags/4.1.2/",
  "https://wordpress.org/plugins/wedevs-project-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wedevs-project-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}