CVE-2025-8994

Name of the Vulnerable Software and Affected Versions WP Project Manager plugin for WordPress versions prior to 2.6.27

Description The WP Project Manager plugin for WordPress is susceptible to a time-based SQL Injection issue. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries, specifically affecting the completed at operator parameter. Authenticated attackers with Subscriber-level access or higher can inject additional SQL queries into existing queries to extract sensitive information from the database.

Recommendations Update the WP Project Manager plugin to version 2.6.27 or later.