Risk Letters

Exploited vulnerability

CVE-2026-116512

TLP:CLEAR

weDevs wp_project_manager Unrestricted Upload of File with Dangerous Type

The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as

Facts

  • Vendor: weDevs
  • Product: wp_project_manager
  • CVSS: 9.8
  • EPSS (probability of exploitation within 30 days): 0.6 %
  • First known exploitation: 30 October 2026
  • First seen by Risk Letters: 31 October 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD