Project Manager for WordPress: remote code execution (CVE-2026-116512)
A vulnerability, CVE-2026-116512 (CVSS 9.8), was published for the Project Manager plugin for WordPress. The 'id' parameter is concatenated into a validation rule string, and each token is called as a dynamic PHP function with no allowlist.
Checked in Shield: no
Who is affected
All plugin versions up to and including 4.1.1 are affected. No authentication is needed: WordPress runs validate_callback before permission_callback, so the capability check is never reached on this code path.
How to check
In the WordPress admin, open the Plugins page and find Project Manager. If the installed version is 4.1.1 or lower, the site is within the affected range.
How to fix
The source does not name a fixed version. Watch for a plugin update and install the patch when it is released. Until then, consider deactivating the plugin temporarily.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
A fixed version and any exploitation in the wild are not disclosed yet. Source: NVD, CVE-2026-116512.
