CVE-2026-116512 in Project Manager Plugin
Summary
by MITRE • 10/31/2026
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP function with no allowlist check. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable by unauthenticated attackers because WordPress core executes the route argument's validate_callback inside WP_REST_Server::dispatch() before the route's permission_callback is invoked, meaning the Project_Manage_Capability authorization gate is never reached on the vulnerable code path.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified in the Project Manager plugin for WordPress represents a critical Remote Code Execution flaw affecting all versions up to and including 4.1.1. This security issue stems from improper input validation within the REST API endpoint handling project identifiers. Specifically, the id parameter is accepted without adequate sanitization or type checking before being processed by the application logic. The core of the vulnerability lies in how this unsanitized value is utilized: it is directly concatenated into a pipe-delimited string that defines validation rules for other parameters. This design choice creates a dangerous execution path where user-supplied data influences code structure rather than just data content, setting the stage for arbitrary command execution on the underlying server infrastructure.
The technical mechanism of exploitation relies on PHP's dynamic function invocation capabilities combined with insufficient access control checks during the REST API request lifecycle. When an unauthenticated attacker submits a crafted id parameter containing specific payloads, such as those utilizing backticks or shell metacharacters, these values are embedded into the validation rule string. The application then splits this string by pipe delimiters and iterates through each token to invoke them as dynamic PHP functions using call_user_func_array or similar mechanisms. Because there is no allowlist restricting which functions can be called via this dynamic invocation process, an attacker can supply function names that correspond to system-level commands or other dangerous built-in PHP functions. This effectively bypasses standard input filtering because the validation logic itself becomes the vector for code execution rather than a protective measure.
A critical factor enabling this exploitation is the order of operations within WordPress core's REST API dispatching mechanism. The WP_REST_Server::dispatch() method processes incoming requests by first executing the validate_callback associated with route arguments to ensure data integrity before proceeding further. Crucially, this validation phase occurs prior to the invocation of permission_callback functions that are responsible for authorization checks. In the case of the Project Manager plugin, the capability check intended to restrict access based on user roles is defined in a permission callback. However, because the vulnerable code path triggers during the earlier validation stage, the authorization gate is never reached when an attacker exploits this specific parameter. This architectural oversight allows unauthenticated users to bypass role-based access controls entirely and execute arbitrary PHP code with the privileges of the web server process.
The operational impact of this vulnerability is severe, as it grants attackers full control over the compromised WordPress installation. Successful exploitation can lead to complete system compromise, including the ability to read sensitive files such as database configuration credentials, modify website content, install malicious plugins or backdoors, and pivot into other systems within the network environment. Since the attack requires no authentication, it is easily scalable by automated bots scanning for vulnerable instances across the internet. This significantly increases the risk of widespread infection campaigns targeting WordPress sites that have not yet applied updates to mitigate this flaw. The ability to execute code as the web server user also means attackers can potentially escalate privileges further depending on the host system's configuration and security posture.
Mitigation strategies must prioritize immediate remediation through software updates or manual intervention if updating is not immediately feasible. Administrators should upgrade the Project Manager plugin to version 4.1.2 or later, where this vulnerability has been patched by implementing strict allowlists for dynamic function calls and enforcing proper input sanitization before concatenation into validation strings. For sites unable to update immediately, temporary mitigations include restricting access to the WordPress REST API endpoints via web server configuration rules if possible, although this may impact legitimate functionality. Additionally, deploying a Web Application Firewall with signatures capable of detecting PHP execution attempts through parameter manipulation can provide an additional layer of defense against exploitation attempts while permanent fixes are applied.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code or Script, commonly known as injection flaws, specifically involving dynamic code evaluation. It also maps to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, where attackers leverage legitimate system features for malicious purposes. The lack of authentication required places it in the category of unauthenticated attacks, highlighting the importance of validating all inputs regardless of their perceived trust level within API endpoints. Security teams should audit similar patterns across other plugins that utilize dynamic function invocation based on user input to prevent analogous vulnerabilities from being exploited elsewhere in the ecosystem.