CVE-2026-116512

CVE-2026-116512 is an unauthenticated remote code execution flaw in the Project Manager plugin for WordPress by weDevs. The plugin slug is wedevs-project-manager. It has more than 5,000 active installs.

Wordfence, the CVE Numbering Authority, scores it CVSS 3.1 9.8 (Critical). NVD has not added its own score. The NVD record status is Received.

The flaw. The plugin builds a validation rule string from the REST 'id' parameter without cleaning it. It then calls each piece of that string as a PHP function, with no allowlist. So an attacker can choose which functions run.

Why no login is needed. WordPress core runs a route's validation callback before its permission callback. The plugin's capability check is never reached on this path.

CWE: CWE-434 per the CNA, though the described flaw is function injection. CWE-94 (code injection) fits the description better.

Affected and fixed versions

The 4.1.2 changelog says: "Security: Fixed a security issue in how project changes are checked before they are saved. Reported by Wordfence." The fix is WordPress plugin changeset 3772103.

Timeline (UTC+1)

• 26 October 2026, 14:32: vendor notified.
• 29 October 2026, 06:09: version 4.1.2 released.
• 30 October 2026, 20:25: public disclosure by Wordfence.
• 31 October 2026, 08:46: CVE record published.
• 31 October 2026, 09:16: NVD record published.
• 31 October 2026, 10:31: GitHub advisory GHSA-3j45-2638-6g5h published.
• 1 November 2026: public exploit published on GitHub.

Wordfence credits Osman Hussein.

Public exploit (2 November 2026)

A public exploit was published on 1 November 2026. It is a weaponized mass-exploitation tool, not a research PoC. It automates dropping a webshell on vulnerable sites. It targets this plugin's REST route and its 'id' parameter.

ThreatWire read the code but has not run it. We do not reprint any steps, requests, or code. Do not run it outside an isolated lab, and only against systems you own. The PoC link field points to the repository.

Exploitation status: CISA has not added this CVE to KEV (catalog 2026.10.30). CVE.org, NVD, GitHub and the vendor do not report attacks. We could not read the Wordfence advisory page, so we cannot confirm any attack statistics there. The EPSS score was 0.00584 on 31 October, before the exploit appeared.

Facts checked on 2 November 2026.

What to do: update the plugin to 4.1.2 now. If you cannot, deactivate or remove it. Then look for signs of compromise. Our explainer covers the checks.