A WordPress project management plugin carries a 9.8-rated flaw that lets an unauthenticated visitor execute code on the server. The fix shipped two days before the disclosure, so any site that does not auto-update plugins is still exposed.
What happened
Wordfence published CVE-2026-116512 on 30 October 2026 and scored it 9.8 under CVSS 3.1. Project Manager takes the REST API id parameter and concatenates it into a pipe-delimited validation rule string, then calls each token in that string as a PHP function with no allowlist. WordPress runs a route's validation callback before it runs the permission check, so the plugin's own capability gate is never reached.
The outcome is unauthenticated remote code execution in every version up to and including 4.1.1. weDevs shipped 4.1.2 on 29 October 2026 and the changeset is public.
Who is affected
- Any WordPress site running Project Manager at 4.1.1 or earlier
- Sites where the plugin is installed but the project features are barely used, since the REST route is registered regardless
- Multisite networks where a single site is on a vulnerable version
What to do now
Update Project Manager to 4.1.2 or later, or deactivate it until you can. No setting mitigates an unauthenticated REST route.
- Check the plugin version on every site you manage, including staging and forgotten brochure sites
- Update to 4.1.2 and confirm the version actually changed
- If you cannot update today, deactivate and delete the plugin
- For any site that ran a vulnerable version on a public host, review admin users, scheduled tasks and recently modified PHP files for dropped shells
What this means for South African businesses
South African SMEs rarely treat the company website as production infrastructure, yet it usually holds the mail domain, the client list and the payment links. A 9.8 unauthenticated RCE in a plugin nobody remembers installing is how a marketing site becomes the entry point for a POPIA notification. The fix landed two days before anyone knew why, which is the practical argument against switching off plugin auto-updates to avoid surprises.
Source: Wordfence advisory for CVE-2026-116512.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.