Security notice
WordPress site using WP Project Manager? A flaw rated 9.8 needs no login. Update to 4.1.2.
WP Project Manager, from the company weDevs, is a WordPress plugin for projects, tasks and Kanban boards. WordPress.org shows 5,000+ active installations. On October 30, 2026, Wordfence disclosed a critical flaw in it, and the CVE record, published October 31 with Wordfence as the assigning authority, rates it 9.8 out of 10. Versions up to and including 4.1.1 let a stranger with no login run code on your server, because the plugin's permission check is not reached on the vulnerable path. Version 4.1.2, released October 29, fixes it. We found no report of attacks, and CISA does not list it as exploited. If your site runs WP Project Manager, update to 4.1.2 or later today. If you cannot, ask your developer about deactivating it until you can.
What happened
- The flaw. The CVE record describes "Remote Code Execution" with no login needed. In plain words, the plugin takes text that arrives with a web request and can end up running it as a command on your server. The CVE record says the plugin's permission check, which should stop strangers, is never reached on this path. We are leaving out the technical details. (CVE record)
- How serious. The CVE record rates it CVSS 9.8, which is 9.8 out of 10 and critical: reachable over the internet, low complexity, no account and no visitor interaction needed. Running code on your server can give an attacker control of the whole site. (CVE record)
- Affected and fixed versions. WP Project Manager 4.1.1 and earlier. Version 4.1.2 is the fixed version. The plugin's folder name is
wedevs-project-manager, and WordPress.org lists it under a long name that starts "Project Manager" and ends "Time Tracker." (CVE record, WordPress.org) - The dates. The CVE record says the vendor was notified on October 26. WordPress.org shows 4.1.2 was released on October 29. Wordfence disclosed the flaw on October 30, and the CVE record was published on October 31. So the fix came out about a day before the public details, and a site that updated since October 29 already has it. (CVE record, WordPress.org)
- What the changelog says. The 4.1.2 entry on WordPress.org reads: "Security: Fixed a security issue in how project changes are checked before they are saved. Reported by Wordfence. We recommend updating right away." It does not name the CVE number. (WordPress.org)
- How many sites. WordPress.org shows 5,000+ active installations. (WordPress.org)
- No attacks reported yet. We found no report that it is being attacked. CISA KEV does not list it in its version dated October 30, 2026, and the NVD entry does not mention exploitation. That does not mean it has not been attacked: the details have been public since October 30. The NVD entry was still waiting for its own review when we checked. (NVD)
- The paid Pro add-on: not confirmed. The CVE record names only the plugin on WordPress.org. We found no statement about WP Project Manager Pro. The plugin's changelog says that version 4.1.0 and later need WP Project Manager Pro 4.1.0 or newer, so if you use Pro, check it is up to date as well. (CVE record, WordPress.org)
Who should worry
This is about WordPress websites that use the WP Project Manager plugin to run projects, tasks or Kanban boards. If you are not sure whether your site uses it, ask your web developer or agency. Ask about this if any of these are true:
- Your WordPress site uses WP Project Manager and is on version 4.1.1 or earlier.
- Your team or clients manage work inside your WordPress site.
- Automatic plugin updates are off on your site, or you are not sure they are on.
- An agency or developer set up your project tools and you do not know which plugin runs them.
- You run a web agency or host and look after WordPress sites for clients.
If your site does not use WP Project Manager, this notice does not apply to you.
What to do now
Do these today.
- Check if you have it. In your WordPress dashboard, open Plugins, then Installed Plugins, and look for "Project Manager" from weDevs. Note the version number. If it says 4.1.2 or higher, you have the fix.
- Update. Update the plugin to 4.1.2 or later. Take a backup first. Updating does not change the minimums: the WordPress.org files list WordPress 6.2 and PHP 7.4 for both 4.1.1 and 4.1.2. If you also use WP Project Manager Pro, update it too. (WordPress.org)
- If you cannot update today, ask your developer or host whether to deactivate the plugin until you can. That is a general precaution, not the plugin maker's advice, and your team will lose access to projects and tasks while it is off. We found no other workaround in the sources. (WordPress.org)
- Check for a break-in. No signs of attack have been published, so there is nothing specific to look for. As a general check, especially if you were on 4.1.1 or earlier for several days, ask your developer or host to look for administrator accounts you do not recognize, plugins you did not install and PHP files you did not put there, and to check your server logs for unusual requests to the plugin.
- Check your site afterwards. Open a project and a task and confirm they still load.
What to send your developer, agency or host
WP Project Manager (wedevs-project-manager) 4.1.1 and earlier has an unauthenticated remote code execution flaw, CVE-2026-116512 (CVSS 9.8, assigned by Wordfence, published October 31, 2026). It is fixed in 4.1.2, released October 29. CISA does not list it as exploited and we found no report of attacks. Please tell us whether our site runs this plugin and which version. If it is 4.1.1 or earlier, please update to 4.1.2 or later today, or deactivate it until you can, update WP Project Manager Pro if we use it, and tell us if you checked for unfamiliar administrators, plugins or PHP files. Sources: the CVE record, NVD, WordPress.org.
Common questions
Has my site been hacked?
This notice does not mean your site has been hacked. It means a critical flaw has been published and a fix is out. We found no report of attacks.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see which plugins your site runs or which versions they are on, so if our scan does not warn you about this plugin, that does not mean you are safe. Our free scan does look at your home page for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.
I updated on October 29 or later. Am I covered?
If your plugin shows 4.1.2 or higher, you have the fix. Plugin updates can be turned off or fail, so check the version.
Does the update change my WordPress or PHP requirements?
No. The WordPress.org plugin files list WordPress 6.2 and PHP 7.4 as the minimums for both 4.1.1 and 4.1.2.
Is it being exploited?
We found no report that it is, and CISA does not list it. The fix has been public since October 29 and the details since October 30.
Where can I follow official updates?
The WordPress.org changelog and the NVD entry. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- CVE Program: CVE-2026-116512, published October 31, 2026 by Wordfence, checked November 1, 2026
- NVD: CVE-2026-116512, published October 31, 2026, checked November 1, 2026
- WordPress.org: WP Project Manager plugin page and changelog, version 4.1.2, checked November 1, 2026
- CISA: Known Exploited Vulnerabilities Catalog, catalog version dated October 30, 2026, checked November 1, 2026