CVE-2026-116512: Remote Code Execution in Project Manager Plugin

CVE-2026-116512 is a Remote Code Execution vulnerability in the Project Manager – AI Powered Project Management plugin for WordPress. The flaw resides in the 'id' parameter, which is concatenated directly into a validation rule string without any sanitization. This parameter is then split and each token is invoked as a dynamic PHP function without allowlist validation. An unauthenticated attacker can exploit the WordPress REST API flow to execute arbitrary code on the server, bypassing authorization controls.

With a CVSS score of 9.8 (critical), this flaw poses an immediate and severe threat. No authentication is required: anyone with internet access can attempt exploitation. The vulnerability was published today (October 31, 2026) and has also been reported on social media. The availability status of a patch is not yet confirmed in official data. If you are a WordPress site administrator using this plugin, response time is critical.

Immediate action: disable or remove the Project Manager plugin from all WordPress installations. If the plugin is critical to operations, contact the developer to verify patch status. Meanwhile, monitor REST API access logs to detect suspicious requests to the plugin endpoint. Check if updates have been released in versions after 4.1.1. Informing your IT team and CISO of this vulnerability's criticality is necessary to coordinate response efforts.