WP Project Manager plugin is vulnerable to a time‑based SQL injection via the ‘completed_at_operator’ parameter. The injection arises from insufficient escaping and a lack of prepared statements, allowing an attacker to append additional SQL clauses. Because the vulnerability can be exploited only by authenticated users with Subscriber role or higher, an attacker can extract sensitive information from the database by injecting payloads that alter query logic.

WordPress sites running the WP Project Manager plugin by WeDevs, any version up to and including 2.6.26 are affected. Vendors affected are WeDevs with the Project Manager plugin. Exact versions impacted are 2.6.26 and all earlier releases.

The CVSS score of 6.5 indicates a moderate severity level. The EPSS score of less than 1% suggests very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need authenticated access with Subscriber privileges or higher, which limits the reach but still poses a threat to organizations with many authorized users.