# Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker <= 4.1.1 - Authenticated (Subscriber+) Remote Code Execution via Project 'id' Parameter

- **ID:** WPSEC-2026-1993
- **Plugin:** Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker (`wedevs-project-manager`), https://wordpress.org/plugins/wedevs-project-manager/
- **Affected versions:** all versions before 4.1.2
- **Fixed in:** 4.1.2 (Update to 4.1.2 or later.)
- **Severity:** High 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wedevs-project-manager
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1993/

## Description

The Project Manager plugin for WordPress is vulnerable to Remote Code Execution via the project 'id' parameter in all versions up to, and including, 4.1.1. This is due to the project update validator concatenating the unsanitized request id into its validation rule string, and the validator calling any PHP function named in a rule when no matching prefixed validator exists. This makes it possible for authenticated attackers who are allowed to update a project, which can include low-privileged users such as subscribers who have been given access to a project, to inject additional rules that call arbitrary PHP functions such as system(), leading to code execution on the server.

## References

- https://wpsec.com/vuln/WPSEC-2026-1993/
- https://plugins.svn.wordpress.org/wedevs-project-manager/tags/4.1.2/
- https://wordpress.org/plugins/wedevs-project-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1993/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.