CYBUNKR

WordPress Project Manager plugin lets anyone run code on your site, and exploit code is out

Published

CVE-2026-116512 in the weDevs Project Manager plugin for WordPress, rated 9.8 out of 10, lets attackers run code without logging in. An exploit script went public on 1 November. Update to 4.1.2 now.

If your WordPress site runs the Project Manager plugin by weDevs (task lists, Kanban boards and time tracking), update it today. CVE-2026-116512, rated 9.8 out of 10, lets an attacker who has not logged in run code on the server (CVE record). That means full control of the site and often the hosting account.

The plugin turns part of a request into PHP function calls without checking them, and WordPress runs that check before it asks whether the visitor is allowed in, so the login check is never reached (CVE record).

Who is affected

  • Project Manager 4.1.1 and earlier (CVE record, Wordfence).
  • Version 4.1.2, released on 29 October, fixes it. Its changelog lists a security fix reported by Wordfence and recommends updating right away (changelog).
  • WordPress.org lists the plugin on more than 5,000 active sites (WordPress.org).

What has been seen so far

A snapshot from 2 November:

  • The CVE was published on 31 October (CVE record). On 1 November an exploit script appeared on GitHub that can run commands, upload a shell and scan lists of sites (BabyMushr00w). CIRCL's Vulnerability-Lookup logged it the same day.
  • We have found no report of exploitation in the wild yet, and it is not in CISA's Known Exploited Vulnerabilities catalog. Public scripts that can scan many sites at once often change that quickly.

Unverified exploit code is sometimes laced with malware, so don't run it to test your own site.

What to do

  • Update Project Manager to 4.1.2 or later from Plugins in the WordPress admin, or ask whoever looks after your site. If you don't use it, deactivate and delete it.
  • Check for webshells, even after updating: look for unexpected .php files in wp-content/uploads/ and new admin users.
  • Stop PHP running in the uploads folder through your web server or hosting settings, so a dropped file can't run.
  • If you find signs of compromise, restore from a clean backup, then change admin, database and hosting passwords.

How we can help

Worried your site has been tampered with? Get in touch.

Sources