CVE-2026-78262

WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability

Published Aug 24, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.

Analysis

Technical impact

Unauthenticated PHP Object Injection in WordPress WP Project Manager plugin versions 4.0.6 and earlier permits an attacker to instantiate malicious PHP objects and execute arbitrary code, resulting in full compromise of the site’s confidentiality, integrity, and availability. This weakness is categorized as CWE‑502.

Affected Systems

Vendors and products affected include weDevs’ WP Project Manager plugin, specifically all installed versions up to and including 4.0.6.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical severity and the vulnerability can be exploited remotely via the web interface with no authentication required. EPSS is not available, but the high CVSS suggests a significant likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, yet its impact warrants immediate remediation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

weDevs

WP Project Manager

unaffected

Version	Status	Constraints
`n/a`	affected	≤ 4.0.6

No data.

Vendor Product Versions

Wedevs

Wp Project Manager

Version	Status	Scheme	Platform
`[0,4.0.6]`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

Vendor Solution

Update the WordPress WP Project Manager Plugin to the latest available version (at least 4.0.7).

OpenCVE Recommended Actions

Apply the latest WP Project Manager plugin update (4.0.7 or later).
Update all WordPress core files and other plugins to their latest versions.
Restrict file upload permissions, disable directory browsing, and monitor site logs for suspicious activity.

Generated by OpenCVE AI on August 24, 2026 at 22:27 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.564% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://patchstack.com/database/wordpress/plugin/wedevs-project-manager/vulnerability/wordpress-wp-project-manager-plugin-4-0-6-php-object-injection-vulnerability?_s_id=cve

History

Aug 27, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 24, 2026 11:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wedevs Wedevs wp Project Manager Wordpress Wordpress wordpress
Vendors & Products		Wedevs Wedevs wp Project Manager Wordpress Wordpress wordpress

Aug 24, 2026 9:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.
Title		WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability
Weaknesses		CWE-502
References		https://patchstack.com/database/wordpress/plugin/wedevs-project-manager/vulnerability/wordpress-wp-project-manager-plugin-4-0-6-php-object-injection-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`