weDevs Project Manager: Remote Code Execution

What happened

WordPress sites using weDevs Project Manager earlier than 4.1.2 are affected by a flaw that can let an attacker run code on the server without signing in. Think of a receptionist following instructions written on a visitor's form before checking whether that visitor is allowed inside. Here, the plugin processes attacker-controlled information before its access check can stop the request.

The vendor's advisory identifies 4.1.2 and later as the fixed versions. NVD describes the issue as remote code execution, meaning someone can cause a server to execute code through a request sent from elsewhere. The vulnerability is tracked as CVE-2026-116512 and has a CRITICAL severity rating.

NVD published the vulnerability on 2026-10-31. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-11-02. The vendor advisory and NVD are the primary references for understanding the affected versions, the underlying flaw and the update.

Technical details

The root cause involves an 'id' parameter, a value supplied as part of a request. The plugin inserts that value directly into a string containing validation rules without sanitizing it. Validation normally checks whether incoming information meets expected requirements. In this case, the rules are separated by pipe characters, and the plugin splits the resulting string into individual pieces.

The dangerous step comes next: those pieces are treated as names of PHP functions and invoked dynamically. PHP is the server-side programming language involved in this execution path. Without an allowlist restricting which functions may be called, attacker-controlled input can influence what the server executes. NVD assigns CWE-434, Unrestricted Upload of File with Dangerous Type, as the weakness classification; its description explains the execution mechanism through validation-rule construction and dynamic function calls.

The attack does not require an authenticated account. WordPress processes the route's validation callback before its permission callback. A callback is a function invoked at a particular processing step; here, the vulnerable validation step runs before the function responsible for checking access. As a result, the plugin's authorization gate is never reached on the vulnerable path. Requiring users to sign in elsewhere on the site does not resolve that ordering problem.

NVD gives CVE-2026-116512 a CVSS 3.1 score of 9.8 and a CRITICAL rating. CVSS, the Common Vulnerability Scoring System, summarizes a vulnerability's technical severity. This rating supports prioritizing the update, particularly because the described path allows server-side code execution without authentication. The score is not evidence of an attack against any particular site.

Who is affected

Everyday users

For everyday users, this issue concerns the WordPress server running weDevs Project Manager. The affected software needs to be updated by whoever maintains that site. You do not need to use the plugin's project-management features personally for the server's installed version to matter.

If you rely on a site that uses weDevs Project Manager, ask its operator whether the installed plugin is 4.1.2 or later. The advisory describes a potential route to server-side code execution; it does not establish whether any particular site's information has been accessed or changed.

Developers

Developers maintaining a WordPress site with weDevs Project Manager should check the deployed plugin version and arrange an update if it is earlier than 4.1.2. An access check elsewhere in the application cannot be assumed to protect a function that runs before that check. The processing order described by NVD is central to why an unauthenticated request can reach the vulnerable behavior.

The implementation also illustrates why validation rules must stay separate from untrusted request values. Turning request text into function names gives that text control over executable behavior. When reviewing similar code, examine how rule strings are assembled, whether callable functions are restricted by an allowlist, and whether validation itself performs sensitive operations before authorization.

Server and IT admins

Server and IT admins should identify WordPress installations running weDevs Project Manager and check their installed versions. Any version earlier than 4.1.2 falls within the affected range. Because the described attack does not require a login, account permissions alone should not be treated as a sufficient response.

Prioritize moving affected installations to 4.1.2 or later and confirming that the update reached each intended site. CVE-2026-116512 is not listed in the CISA Known Exploited Vulnerabilities catalog, commonly called KEV, as of the catalog check. That catalog status does not establish whether exploitation has occurred.

What to do now

1. Identify the WordPress sites you maintain that have weDevs Project Manager installed, and record the installed version for each site.
2. Compare each installed version with the affected range: earlier than 4.1.2. Use the vendor's advisory to confirm the applicable update guidance.
3. Update affected installations to 4.1.2 or later. Follow the update steps in the vendor's advisory.
4. After updating, confirm the installed version on each affected site. An update planned or downloaded still needs to be applied to the installation serving users.
5. Check that the site and the project-management functions your users depend on still work after the update.

If you can't update yet

• If an update must be delayed, check the vendor advisory for guidance on restricting access or reducing internet exposure. Treat these measures as temporary risk reduction while arranging the fixed version.

How to confirm the fix

• Confirm that each affected WordPress installation reports weDevs Project Manager 4.1.2 or later.
• Cross-check the installed version against the fixed-version guidance in the vendor's advisory, and resolve any installation still reporting an earlier version.
• Verify that the site and its usual weDevs Project Manager workflows function after the update. Normal operation is a compatibility check; the installed fixed version is the key confirmation for this advisory.

NVD scores and CISA KEV status

As of November 2, 2026, none of these CVEs is listed in the CISA Known Exploited Vulnerabilities catalog.

Affected products and fixed versions 1 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• WordPress advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/d3e300b3-39cc-4681-a8e8-02d9743f97ff
• NVD: CVE-2026-116512
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on November 2, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.