CVE-2026-116512: weDevs Project Manager Unauth RCE - Floor 4.1.2

CVE-2026-116512 is Wordfence’s name for unauthenticated remote code execution in Project Manager - AI Powered Project Management, Task Management, Kanban Board & Time Tracker (wedevs-project-manager) through 4.1.1. CNA title: Unauthenticated Remote Code Execution via 'id' Parameter Function Injection. CVE state PUBLISHED. datePublished 2026-10-31T07:46:51.642Z.[1][10]

Wordfence (CNA) scores it 9.8 critical (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CNA CWE is CWE-434 (Unrestricted Upload of File with Dangerous Type). NVD vulnStatus is Received; the 9.8 is Primary from security@wordfence.com. NVD has not published a separate Coordinator score. cisaExploitAdd is empty on the NVD object we pulled.[2]

Wordfence Intelligence: publicly published 30 Oct 2026, last updated 31 Oct 2026. Finder: Osman Hussein (Onvio B.V.). Remediation on that row: 4.1.2.[3]

The wordpress.org plugin API this morning returned version 4.1.2, active_installs 5000 (the directory’s 5k bucket), last updated 2026-10-29 5:09am GMT, tested to 7.1.4, requires WP 6.2 / PHP 7.4. Author profile: wedevs. Homepage: https://wedevs.com/wp-project-manager-pro/. Changelog v4.1.2 - Oct 29, 2026: “Fixed a security issue in how project changes are checked before they are saved. Reported by Wordfence. We recommend updating right away.”[4]

What it is

This is a plugin REST validator bug, not WordPress core and not PHP2Shell.[1][3]

Wordfence / CNA text: the unsanitized id parameter is concatenated into a pipe-delimited validation rule string. That string is split, and each token is invoked as a dynamic PHP function with no allowlist. Unauthenticated attackers can execute code on the server. The path is unauthenticated because WordPress core runs the route argument’s validate_callback inside WP_REST_Server::dispatch() before permission_callback, so the plugin’s Project_Manage_Capability gate is never reached on this path.[1][3][10]

Public 4.1.1 source matches that write-up, without us sending a request:

Update_Project::rules() reads $id = $this->request->get_param('id') and builds 'title' => 'required|pm_unique:Project,title,'.$id.[5]
Abstract_Validator::get_validation_fns() is explode('|', $fns). call_validation_fn() takes the token, optionally prefixes wedevs_pm_, and calls $fn_name($value) - no allowlist in 4.1.1. Wordfence’s cited line is L156, the $fn_name($value) return.[6]
WP_Router::apply_validation() (Wordfence’s cited L429) registers that validator as the REST argument’s validate_callback.[7]

4.1.2 adds Abstract_Validator::ALLOWED_RULES (wedevs_pm_required, wedevs_pm_gtz, wedevs_pm_numeric, wedevs_pm_unique, wedevs_pm_kses, wedevs_pm_pro_required) and returns early unless the prefixed name is in that list and function_exists. Comment in that tag: “Rule strings can carry request data: run only known validators, never a raw function name.”[8]

We did not send a REST request or invoke a PHP function through id. Treat “unauth RCE” as Wordfence’s published claim, with the 4.1.1 call site as the part we can read.[3][6]

How serious

A 9.8 with C:H I:H A:H, PR:N, AC:L, UI:N is “unauthenticated, low complexity, total impact on the WordPress process.” Scope is unchanged (S:U): the CNA is scoring the site/process, not a claimed hypervisor breakout.[1][2]

CNA CWE is CWE-434 (dangerous file upload). The title and description are function injection via id. We are not reconciling that mapping. Report the CWE as labeled and the mechanism as Wordfence wrote it.[1][2][3]

Not in CISA KEV as of catalog 2026.10.30 (dateReleased 2026-10-30T17:02:45.3665Z, 1766 entries). Newest dateAdded on that dump: 30 Oct Ivanti Connect Secure - not WordPress. Absence from KEV is not a clean bill of health.[9]

Wordfence Intelligence on this ID does not print an in-the-wild flag on the page we pulled. We did not scan the fleet.[3]

Who is affected

In scope, per the CNA affected block:[1][2]

Product: Project Manager - AI Powered Project Management, Task Management, Kanban Board & Time Tracker (vendor wedevs).
Versions: 0 through 4.1.1 (semver lessThanOrEqual 4.1.1). defaultStatus: unaffected.
Trigger Wordfence published: an unauthenticated call that hits a REST route whose validator concatenates id into the rule string. Update_Project is the file they cited. Inventory the slug and version, not whether you “use Kanban.”[3][5]

Out of scope unless you have a separate advisory:

Sites already on 4.1.2 (API version this morning is 4.1.2).[4]
WordPress core. The core behavior Wordfence names (validate_callback before permission_callback) is why the plugin gate does not save you; the injectable rule string is the plugin’s.[3][7]
WP Project Manager Pro as a CNA product. The affected object is the wordpress.org plugin. 4.1.0’s readme says Free 4.1.0 needs Pro 4.1.0; that is a compatibility note, not a CVE affected range. Do not treat Pro as patched-by-association or as in-scope-by-association.[1][4]

5,000 is wordpress.org active_installs this morning, not a census we ran.[4]

What to do now

Inventory the slug.

# one site
wp plugin get wedevs-project-manager --field=version --path=/home/USER/public_html
wp plugin list --name=wedevs-project-manager --fields=name,status,version --path=/home/USER/public_html

# cPanel box, every account (read-only). Bootstrap on 4.1.2 is cpm.php.
find /home -path '*/wp-content/plugins/wedevs-project-manager/cpm.php' 2>/dev/null \
  | while read -r f; do
      ver=$(awk -F': ' '/^[[:space:]]*\*?[[:space:]]*Version:/{print $2; exit}' "$f")
      echo "$ver  $f"
    done

Ship 4.1.2. That is what wordpress.org is serving. Do not stay on 4.1.1 because 4.1.1’s changelog already mentioned an SVG sanitizer bump - that was a different library fix on 20 Oct.[4]

wp plugin update wedevs-project-manager --path=/home/USER/public_html
wp plugin get wedevs-project-manager --field=version --path=/home/USER/public_html   # want 4.1.2

If you cannot update today: deactivate. A WAF rule is not a version bump. The published path is REST validation, not wp-login.php.[3]

wp plugin deactivate wedevs-project-manager --path=/home/USER/public_html

We are not publishing a payload.

After the bump, look at who owns the site. 4.1.2 does not unwind a PHP file that was already written or an administrator that was already minted. If you have reason to hunt: unexpected administrators in wp_users, PHP files under wp-content dated around 29-31 Oct that were not part of a deploy, then rotate WordPress salts and invalidate sessions. Presence of a new admin is a hunt target for any WP incident, not a fingerprint unique to this CVE.
Unsupported / frozen lines. CNA range is 0 through 4.1.1. There is no 3.x patched build in the record we pulled. Jump a frozen copy through staging, or remove the plugin.[1][4]

Compromise signs

The published class is unauth REST → claimed function invocation / RCE. Hunt for, do not treat as proof:[1][3]

New WordPress administrators you did not create, especially after 29 Oct.
PHP files under wp-content/uploads or the plugin directory dated in the disclosure window that were not part of a deploy.
Unusual POST / PUT volume to /wp-json/ routes whose path includes pm / project-manager, in nginx/Apache logs. We did not name a public endpoint string beyond the files Wordfence cited.
Plugin still reporting ≤ 4.1.1 after you thought you updated.

Absence is not proof of cleanliness. We did not publish a Nuclei template and we did not send a probe.

FAQ

Is this PHP2Shell? No. PHP2Shell is CVE-2026-109618 / 109619 in PHP itself. This ID is weDevs Project Manager’s REST validator.[1][3]

Do I have to be logged in? CNA / NVD vector is PR:N. Wordfence’s reason: validate_callback runs before permission_callback.[1][2][3]

Is every install with the plugin vulnerable? CNA version range is ≤ 4.1.1. Wordfence’s cited plant is Update_Project concatenating id into the rule string. Inventory the version anyway; do not argue yourself out of 4.1.2 because you “only use My Tasks.”[1][5]

Does this give root on the box? Scored scope is unchanged. That is still the web-server user running PHP, not a claimed KVM or panel root. A written PHP file plus a new admin is still a site-takeover.[1][2]

Why is the CWE file-upload? Because Wordfence assigned CWE-434. The published title is function injection. We did not re-CWE it.[1][2]

Is Pro covered? Not as a CNA product. Patch the .org slug you actually run. If you also run Pro, update it from weDevs on its own schedule; that is not this CVE’s floor.[1][4]

Honesty / What we could not verify

We did not exploit this. No REST request was sent. No PHP function was invoked through id.
We did not reconstruct a working payload. Wordfence states unauth RCE; 4.1.1 source shows unsanitized concatenation plus $fn_name($value) with no allowlist. We did not chain that to a specific built-in.
CWE-434 vs function injection is the CNA’s labeling, not something we independently classified.
5,000 is wordpress.org active_installs this morning, not a census we ran.[4]
Not on CISA KEV as of catalog 2026.10.30 / count 1766.[9]
NVD status Received; 9.8 is Wordfence Primary.[2]
In-the-wild: the Wordfence Intelligence page we pulled does not claim active exploitation. Third-party posts that put “actively exploited” in a title without a log sample are not a source we used.

Sources

[1] https://cveawg.mitre.org/api/cve/CVE-2026-116512 - CVE-2026-116512 CNA [2] https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-116512 - NVD CVE-2026-116512 [3] https://www.wordfence.com/threat-intel/vulnerabilities/id/d3e300b3-39cc-4681-a8e8-02d9743f97ff?source=cve - Wordfence Intelligence [4] https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&request%5Bslug%5D=wedevs-project-manager - wordpress.org plugin API [5] https://plugins.svn.wordpress.org/wedevs-project-manager/tags/4.1.1/src/Project/Validators/Update_Project.php - Update_Project 4.1.1 [6] https://plugins.svn.wordpress.org/wedevs-project-manager/tags/4.1.1/core/Validator/Abstract_Validator.php - Abstract_Validator 4.1.1 [7] https://plugins.svn.wordpress.org/wedevs-project-manager/tags/4.1.1/core/Router/WP_Router.php - WP_Router 4.1.1 [8] https://plugins.svn.wordpress.org/wedevs-project-manager/tags/4.1.2/core/Validator/Abstract_Validator.php - Abstract_Validator 4.1.2 allowlist [9] https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json - CISA KEV JSON [10] https://www.cve.org/CVERecord?id=CVE-2026-116512 - CVE.org record