CVE-2026-116512 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-116512 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-116512 is a critical remote code execution (RCE) flaw in the WordPress plugin Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker. Versions up to and including 4.1.1 are vulnerable. An unauthenticated attacker can send a crafted request to the vulnerable REST route and execute arbitrary code on the server.

This is especially dangerous for solo developers and small teams because it can lead to full site takeover, data theft, malware injection, and lateral movement into connected services. No exploitation in the wild is known yet, but the severity is CVSS 9.8, so treat this as an emergency patching issue.

Immediate Action

  • Upgrade immediately to the first fixed release as soon as it is available. If the vendor advisory is not yet published, check the plugin changelog and release notes: vendor advisory / changelog.
  • If you cannot patch within hours, disable the plugin or remove it from production until a fixed version is confirmed.
  • Isolate the WordPress host: restrict outbound network access, limit SSH/admin access, and place the site behind a WAF or maintenance mode if needed.
  • Rotate secrets after patching if you suspect exposure: WordPress salts, database credentials, API keys, and any tokens stored in the site.
  • Review logs for suspicious REST requests and unexpected PHP execution, especially around the plugin’s routes and recent file changes.

Affected Versions

  • project-manager-plugin@<=4.1.1 vulnerable
  • project-manager-plugin@TODO_FIXED_VERSION and later safe
  • If you manage the plugin manually, replace the vulnerable build with the vendor’s patched release as soon as it is posted

Resolution Guide

WordPress / plugin update

# If installed from the WordPress admin UI:
# Dashboard → Plugins → Installed Plugins → Update now

# If you manage plugins via WP-CLI:
wp plugin update project-manager

# If you need to confirm the installed version:
wp plugin list --name=project-manager --fields=name,status,version

Rollback guidance

# If the updated release breaks functionality, restore the last known-good backup
# Avoid rolling back to any version <= 4.1.1
# Keep the site offline or in maintenance mode until a fixed version is validated

Hardening / temporary mitigation

# Disable the plugin if you cannot patch immediately
wp plugin deactivate project-manager

# Optional: block access to the plugin's REST endpoints at the edge/WAF
# Example pattern (adjust to your environment):
# /wp-json/.*/project-manager

Docker / containerized WordPress

# Rebuild the image with the patched plugin version
docker build --no-cache -t my-wordpress:patched .

# Deploy the patched image
docker run -d --name wordpress -p 80:80 my-wordpress:patched

Linux package / host-level containment

# If WordPress is on a VM or bare metal host, restrict egress and file writes
sudo ufw default deny outgoing
sudo ufw allow out 53
sudo ufw allow out 80
sudo ufw allow out 443

# Optional: make the plugin directory temporarily read-only
sudo chmod -R a-w /var/www/html/wp-content/plugins/project-manager

Code fix example (for maintainers)

<?php
// Vulnerable pattern: dynamic invocation from unsanitized input
$rule = $_GET['id'] . '|some_validation';
$parts = explode('|', $rule);
foreach ($parts as $token) {
    if (function_exists($token)) {
        $token($value);
    }
}

// Safer pattern: strict allowlist
$allowed = ['sanitize_text_field', 'absint', 'is_email'];
$token = sanitize_key($_GET['id'] ?? '');
if (!in_array($token, $allowed, true)) {
    return new WP_Error('invalid_rule', 'Invalid validation rule', ['status' => 400]);
}
if (function_exists($token)) {
    $token($value);
}

Detection & Verification

Check whether you are vulnerable

# WordPress CLI version check
wp plugin list --name=project-manager --fields=name,version,status

# File-based check if you do not have WP-CLI
grep -R "Project Manager" wp-content/plugins/project-manager/ -n
grep -R "validate_callback\|explode('|'\|function_exists" wp-content/plugins/project-manager/ -n

Dependency / inventory checks

# If you track plugins in a CMDB or inventory file, search for:
project-manager
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker

Verify the fix

# Confirm the plugin is updated to the fixed version
wp plugin list --name=project-manager --fields=name,version,status

# Confirm the vulnerable code path is gone
grep -R "function_exists\|validate_callback" wp-content/plugins/project-manager/ -n

# Check web logs for suspicious requests to REST endpoints
grep -R "wp-json" /var/log/nginx/ /var/log/apache2/ | grep -i project-manager

Risk and Impact

If exploited, an attacker can run arbitrary PHP on your WordPress server without logging in. That can mean full site compromise: defacement, admin account creation, database theft, plugin/theme tampering, and malware delivery to visitors.

For small teams, the blast radius can extend beyond the website itself if the server stores credentials, deployment keys, backups, or access to cloud services. Treat this as a high-priority incident even though there is no known active exploitation yet.

Keep reading