External risk intelligence

Project Manager for WordPress Plugin Unauthenticated Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-116512

This vulnerability affects a WordPress plugin, which typically operates as a public-facing web application. The flaw is exploitable by unauthenticated attackers via the REST API before permission checks occur, making the vulnerable endpoint directly reachable from the internet as part of standard web traffic.

Unrestricted File Upload

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a popular WordPress plugin, impacting its ability to securely manage projects and tasks. This issue allows for remote code execution, meaning unauthorized individuals could potentially run their own code on affected servers, posing a significant risk to data and system integrity. The main concern is confirming relevance and exposure to understand the potential impact on our operations.

Plugin allows remote code execution on WordPress sites.
Critical flaw means unauthenticated attackers can gain control.
Verify plugin usage and assess potential system compromise.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending a crafted request to the WordPress REST API. The plugin's routing mechanism incorrectly processes an 'id' parameter, allowing it to invoke arbitrary PHP functions before any authorization checks are performed. This bypasses security controls and enables the attacker to execute commands on the server.

Requires no user authentication.
Triggers via a malformed 'id' parameter.
Leads to unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could execute arbitrary code on the server when supported by the advisory. This is because the plugin's 'id' parameter is not properly sanitized, allowing it to be used in a way that invokes dynamic PHP functions without proper validation, bypassing authorization checks.

Server-side code execution.
Unsanitized input allows function invocation.
Compromise of server and hosted data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Project Manager plugin for WordPress presents a critical remote code execution risk. WordPress administrators and infrastructure teams are likely responsible for this plugin's deployment. The first practical move is to identify all WordPress instances, determine their exposure and business criticality, and then assess the scope of the vulnerability.

Ownership: WordPress administrators and infrastructure teams.
Verify first: Plugin presence and network exposure.
Action: Plan remediation during maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Project Manager WordPress plugin?

The Project Manager plugin is a tool used within WordPress websites to facilitate project planning, track time, manage tasks, and organize work via Kanban boards. It functions as an extension of the WordPress platform, allowing administrators to centralize team workflows and project data directly within their site's backend.

How does CVE-2026-116512 lead to remote code execution?

This vulnerability is classified as Improper Control of Generation of Code. The plugin incorrectly handles user input by taking the 'id' parameter and using it to dynamically trigger PHP functions. Because this process lacks an allowlist or proper sanitization, an attacker can supply specially crafted data to force the server to execute unintended, arbitrary code.

Do I need to be logged in for an attacker to trigger this bug?

No. The flaw exists in a path that the WordPress REST API processes before it verifies user permissions. Because the authorization check is bypassed entirely, an unauthenticated attacker can trigger the vulnerability simply by sending a crafted request to the site. Requests that do not include the specific, malformed 'id' parameter needed to trigger the dynamic function call will not activate this bug.

Is my site at risk if I use this plugin?

If you are running a version of the Project Manager plugin up to and including 4.1.1, your site is at risk. Halo Surface Signal indicates that because this plugin operates as a public-facing web application and the vulnerable endpoint is reachable via standard internet traffic, any instance of this plugin is considered exposed to remote, unauthenticated attempts to take control of the server.

When should I prioritize fixing this vulnerability?

You should treat this as a high-priority task. Begin by identifying all WordPress instances in your environment where this specific plugin is installed. Once you have a complete inventory, assess which sites are internet-facing and contain sensitive data. Coordinate with your team to plan the necessary updates during your next maintenance window to close this security gap.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.