The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 4.0.1. The vulnerability stems from insufficient escaping of user‑supplied parameters and a lack of prepared statements. As a result, authenticated users with Subscriber level or higher can append additional SQL statements to existing queries, enabling the extraction of sensitive data from the database. While the primary impact is data exfiltration, the injection can also lead to modification or deletion of database records if an attacker supplies malicious update statements.

All releases of WP Project Manager Pro published by WeDevs up to version 4.0.1 are affected. Any WordPress site that has the plugin installed and has not upgraded to a later version is at risk. Users should verify the installed plugin version and apply the appropriate update.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The lack of a publicly available EPSS score leaves the exploitation probability uncertain, but the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated account with at least Subscriber privileges, so a credential compromise or an existing legitimate user credential can be used to construct the SQL injection. Once sufficient privileges are achieved, the attacker can read or alter sensitive database contents, potentially compromising user data and site integrity.