Scan my site freeScan free

Fix guides / Security notices

Security notice

WordPress site using WP Project Manager? A flaw rated 9.8 needs no login. Update to 4.1.2.

Last updated: Tuesday, November 3, 2026, 8:24 AM ETStatus: Fix released. Attack tool public. Update now.

WP Project Manager, from the company weDevs, is a WordPress plugin for projects, tasks and Kanban boards. WordPress.org shows 5,000+ active installations. On October 30, 2026, Wordfence disclosed a critical flaw in it, and the CVE record, published October 31 with Wordfence as the assigning authority, rates it 9.8 out of 10. Versions up to and including 4.1.1 let a stranger with no login run code on your server, because the plugin's permission check is not reached on the vulnerable path. Version 4.1.2, released October 29, fixes it. A ready-made attack tool for this flaw has been public on GitHub since November 1, according to ThreatWire. We found no report of a confirmed break-in, and CISA does not list it as exploited. If your site runs WP Project Manager, update to 4.1.2 or later today. If you cannot, ask your developer about deactivating it until you can. Either way, check your site for signs of a break-in, as described below.

What happened

Who should worry

This is about WordPress websites that use the WP Project Manager plugin to run projects, tasks or Kanban boards. If you are not sure whether your site uses it, ask your web developer or agency. Ask about this if any of these are true:

If your site does not use WP Project Manager, this notice does not apply to you.

What to do now

Do these today.

  1. Check if you have it. In your WordPress dashboard, open Plugins, then Installed Plugins, and look for "Project Manager" from weDevs. Note the version number. If it says 4.1.2 or higher, you have the fix.
  2. Update. Update the plugin to 4.1.2 or later. Take a backup first. Updating does not change the minimums: the WordPress.org files list WordPress 6.2 and PHP 7.4 for both 4.1.1 and 4.1.2. If you also use WP Project Manager Pro, update it too. (WordPress.org)
  3. If you cannot update today, ask your developer or host whether to deactivate the plugin until you can. That is a general precaution, not the plugin maker's advice, and your team will lose access to projects and tasks while it is off. We found no other workaround in the sources. (WordPress.org)
  4. Check for a break-in. We found no confirmed break-ins, but a ready-made attack tool is public, so check, especially if you were on 4.1.1 or earlier at any point since October 30. ThreatWire advises asking your developer or host to look for PHP files you did not add in wp-content/uploads and in the plugin folders, for new administrator accounts, and for unusual requests to the plugin's pm/v2 routes in your server logs. If you find anything, ThreatWire advises treating the site as compromised: restore from a known-good backup, then change the WordPress admin and database passwords and the WordPress salts. Updating the plugin does not remove anything an attacker has already left behind. (ThreatWire)
  5. Check your site afterwards. Open a project and a task and confirm they still load.

What to send your developer, agency or host

WP Project Manager (wedevs-project-manager) 4.1.1 and earlier has an unauthenticated remote code execution flaw, CVE-2026-116512 (CVSS 9.8, assigned by Wordfence, published October 31, 2026). It is fixed in 4.1.2, released October 29. A ready-made attack tool for it has been public since November 1, according to ThreatWire. CISA does not list it as exploited and we found no report of a confirmed break-in. Please tell us whether our site runs this plugin and which version. If it is 4.1.1 or earlier, please update to 4.1.2 or later today, or deactivate it until you can, and update WP Project Manager Pro if we use it. Please also check wp-content/uploads and the plugin folders for PHP files nobody added, look for new administrator accounts and for unusual requests to the plugin's pm/v2 routes in the server logs, and tell us what you find. If anything looks wrong, please treat the site as compromised, restore a known-good backup and change the admin and database passwords and the WordPress salts. Sources: the CVE record, NVD, WordPress.org, ThreatWire.

Common questions

Has my site been hacked?

This notice does not mean your site has been hacked. It means a critical flaw has been published, a fix is out and a ready-made attack tool is public. We found no report of a confirmed break-in. See the break-in checks above.

Can EverThread tell me if I am affected?

No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see which plugins your site runs or which versions they are on, so if our scan does not warn you about this plugin, that does not mean you are safe. Our free scan does look at your home page for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

I updated on October 29 or later. Am I covered?

If your plugin shows 4.1.2 or higher, you have the fix. Plugin updates can be turned off or fail, so check the version.

Does the update change my WordPress or PHP requirements?

No. The WordPress.org plugin files list WordPress 6.2 and PHP 7.4 as the minimums for both 4.1.1 and 4.1.2.

Is it being exploited?

We found no report of a confirmed break-in, and CISA does not list it. But a ready-made attack tool has been public since November 1, according to ThreatWire, the fix has been public since October 29 and the details since October 30. Update now rather than wait.

Where can I follow official updates?

The WordPress.org changelog and the NVD entry. All current notices are on our notices page.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

We email you a link to confirm first, and every alert has a one-click unsubscribe. Alerts can include a short note about EverThread. Already a customer? Use your account email and your alerts include a link to your dashboard. Privacy

Sources

While you are here

Check your site's other basics free. We look at your home page the way a browser does and tell you in plain English. This scan cannot see which WordPress plugins your site runs or which version they are on. No account.

Or sign up free and we check it every day and email you when something changes.