The Project Manager WordPress plugin is vulnerable because an "id" request parameter is concatenated into a pipe‑delimited validation rule string without sanitization. The resulting string is split and each token is invoked as a PHP function using dynamic function calls with no allowlist. This permits an attacker to inject arbitrary PHP function calls, achieving code execution on the server. The flaw is a direct Remote Code Execution vulnerability (CWE‑434) that compromises confidentiality, integrity, and availability of the affected WordPress site.

WordPress sites running the Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin version 4.1.1 or earlier are affected. The vulnerability exists in all releases up to and including 4.1.1.

The CVSS score of 9.8 indicates a Critical severity. EPSS information is not available, and the vulnerability has not been listed in the CISA KEV catalog, but the exploit path requires no authentication and occurs before any authorization checks. The likely attack vector is an unauthenticated HTTP request to the plugin’s REST endpoint, where the unsanitized "id" parameter is processed. This makes the vulnerability practical to exploit on any public WordPress installation that has the plugin installed and the vulnerable route exposed.