CVE-2026-116512

Name of the Vulnerable Software and Affected Versions Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker versions prior to 4.1.2

Description Unauthenticated attackers can achieve remote code execution on the server. The issue occurs because the id parameter is concatenated directly into a pipe-delimited validation rule string without sanitization. This string is subsequently split, and each resulting token is invoked as a dynamic PHP function without an allowlist check. This flaw is exploitable because WordPress core executes the validate callback within WP REST Server::dispatch() before the permission callback is triggered, bypassing the Project Manage Capability authorization gate.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.