Critical RCE Flaw in WordPress Project Manager Plugin
CVE-2026-116512 carries a CVSS score of 9.8 and affects Project Manager versions up to 4.1.1; weDevs fixed it in version 4.1.2.
A critical vulnerability in the WordPress project management plugin Project Manager was disclosed on October 31, 2026, tracked as CVE-2026-116512 with a CVSS 3.1 score of 9.8. All versions up to and including 4.1.1 are affected.
The flaw stems from insufficient input validation and permission checks when handling external request parameters, allowing unauthenticated attackers to run arbitrary commands on the server.
Developer weDevs released version 4.1.2 on October 29, 2026 to fix the vulnerability, two days before the disclosure. Site administrators running the plugin should update to that version.
The plugin offers project scheduling, team collaboration, task assignment and AI-based task creation features.
Quick answers
Which versions of Project Manager are affected by CVE-2026-116512?
All versions up to and including 4.1.1.
How severe is the Project Manager vulnerability?
It has a CVSS 3.1 score of 9.8 and allows unauthenticated attackers to run arbitrary commands on the server.
Which version fixes the flaw?
Version 4.1.2, released by weDevs on October 29, 2026.