The vulnerability is a subscriber-level SQL injection in WP Project Manager Pro versions 4.0.1 and earlier. Attackers who can craft input directed at the plugin can manipulate SQL queries, potentially leading to unauthorized data access or, if the database is exploited further, remote code execution. The flaw is a classic example of CWE-89, where unsanitized user input is incorporated into SQL statements.

This issue affects the weDevs Pte. Ltd WordPress plugin WP Project Manager Pro. All installations running any version of the plugin up to and including 4.0.1 are impacted. The vulnerability is tied to the WordPress plugin ecosystem and any sites that have the plugin installed and enabled.

The CVSS score of 8.5 indicates a high severity, and while the EPSS score is not available, the absence of a KEV listing suggests no publicly confirmed exploits yet. Based on the description, the likely attack vector is through HTTP requests to the plugin’s endpoints that accept subscriber input. An adversary only needs the ability to inject payloads into those inputs and does not require elevated privileges beyond those of a subscriber user. Once the injection condition is met, the attacker can read, modify, or delete data stored in the WordPress database and might elevate the impact to code execution if the database can be coerced into running arbitrary statements.