wedevs Project Manager: remote code execution

wedevs Project Manager

The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter.

Do this now

Check the vendor's advisory for a fix, and restrict access to the wedevs Project Manager plugin's endpoints until one is confirmed.

Still cooking for Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker.

First seen: 1 Nov 2026
Last update: 1 Nov 2026, 21:17 UTC
Identifiers: CVE-2026-116512
CVSS: 9.8
Source: news
On the menu as: WordPress

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## wedevs Project Manager: remote code execution
Severity: critical. Patch status: fix status unknown.
Affected: wedevs Project Manager
Ids: CVE-2026-116512

The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter.

## Steps
1. Search the repo, its CI and infra config for wedevs Project Manager. If present, report the version in use and whether it's affected.
2. Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker <= 4.1.1: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker <= 4.1.1 | not named in the CVE record | check the vendor advisory: https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/core/Router/WP_Router.php#L429 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-116512") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-116512 https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/core/Router/WP_Router.php#L429
https://pwned.coffee/i/the-project-manager-ai-powered-project-management-task-m-cve-2026-116512

Receipt

Exploitation: No known exploitation
Checked by hand “The CVE record names weDevs Project Manager, a WordPress plugin.” source
Fix by release line: Product Affected Fixed in Source
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker <= 4.1.1 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 3 Nov
The CVE record names no fix for one line; the vendor’s advisory may: plugins.trac.wordpress.org
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (CNA Wordfence) for CVE-2026-116512
Last checked: 4 Nov 2026, 08:18 UTC

Product	Affected	Fixed in	Source
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker	<= 4.1.1	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 3 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Totalone very hot coffee