Patch weDevs Project Manager now: public exploit drops webshells via unauthenticated RCE (CVE-2026-116512)

Timing: weDevs shipped the fix on 29 October 2026. A public exploit appeared on 1 November. We checked all facts on 2 November 2026.

What happened

An unauthenticated attacker can run code on a WordPress site through the Project Manager plugin by weDevs. The flaw is CVE-2026-116512. Wordfence, the CVE Numbering Authority, rates it CVSS 3.1 9.8 (Critical).

The bug sits in the plugin's REST API. The 'id' parameter is pasted into a validation rule string. The plugin then calls each piece of that string as a PHP function. There is no allowlist.

No login is needed. WordPress core runs a route's validation step before its permission check. So the plugin's capability check is never reached.

On 1 November 2026, a public exploit was published on GitHub. It is a weaponized mass-exploitation tool, not a research PoC. It automates dropping a webshell on vulnerable sites. ThreatWire has not run it. Do not run it outside an isolated lab, and only against systems you own.

Who is affected

Any WordPress site running the plugin at version 4.1.1 or earlier is affected. The full name is "Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker". Its slug is wedevs-project-manager.

WordPress.org lists more than 5,000 active installs. Version 4.1.2, released on 29 October 2026, fixes the flaw.

The site does not need any special setting. The plugin only has to be active and reachable over the web.

What is confirmed

• The flaw and the fix. Wordfence describes the flaw in all versions up to 4.1.1. The fix is WordPress plugin changeset 3772103.
• The changelog. Version 4.1.2 says: "Security: Fixed a security issue in how project changes are checked before they are saved. Reported by Wordfence."
• The score. CVSS 3.1 9.8 from Wordfence. NVD has no score of its own yet.
• The timeline. weDevs was notified on 26 October. Wordfence disclosed on 30 October. The CVE record went live on 31 October.
• The credit. Wordfence credits Osman Hussein.
• The exploit exists. ThreatWire read its code. It targets this exact REST route and parameter. It plants a webshell that has no password, so anyone who finds it can use it.

What is not confirmed

Attacks in the wild. CISA has not added this CVE to KEV (catalog 2026.10.30). CVE.org, NVD, GitHub and weDevs do not report exploitation. We could not read the Wordfence advisory page, so we cannot confirm any attack figures there.

The CWE. CVE.org, NVD and GitHub list CWE-434 per the CNA, though the described flaw is function injection. CWE-94 (code injection) fits better.

Risk scores. The EPSS score was 0.00584 on 31 October. That was before the exploit went public, so it may rise.

ThreatWire has not run the exploit. We do not reprint any steps, requests or code. Do not run it outside an isolated lab, and only against systems you own.

What to do

1. Update now. Install Project Manager 4.1.2 or later from the WordPress dashboard.
2. Can't update? Deactivate or remove the plugin until you can. (ThreatWire advice.)
3. Look for webshells. Check wp-content/uploads and the plugin folders for PHP files you did not add. (ThreatWire advice.)
4. Check accounts. Look for new administrator users. (ThreatWire advice.)
5. Read your logs. Look for unusual REST requests to the plugin's pm/v2 routes. (ThreatWire advice.)
6. Found something? Treat the site as compromised. Restore from a known-good backup. Rotate WordPress admin and database passwords, and the WordPress salts. (ThreatWire advice.)

For another recent WordPress plugin case, see our story on Bricksforge flaw CVE-2026-85097.

Sources

Record: CVE-2026-116512.

Sources: the Wordfence advisory, NVD, the CVE.org record, GitHub advisory GHSA-3j45-2638-6g5h, WordPress plugin changeset 3772103, the plugin page, the exploit repository and the CISA KEV catalog. Links are in the references list.