Executive brief
WP Project Manager is a popular WordPress plugin used to organize and manage projects and tasks on websites. Attackers can exploit an unauthenticated PHP Object Injection vulnerability to execute arbitrary code on affected servers, potentially compromising site data, disrupting operations, and allowing further attacks. The flaw affects versions 4.0.6 and earlier and requires only network access—no login credentials needed.
Technical details
The vulnerability is a PHP Object Injection flaw in WP Project Manager versions ≤ 4.0.6 that allows unauthenticated remote code execution. The affected plugin fails to properly validate or sanitize serialized object data before deserialization, enabling attackers to craft malicious payloads that instantiate and invoke arbitrary PHP classes. Attack requires only network access to the WordPress site; no authentication or user interaction is needed. Successful exploitation allows attackers to execute arbitrary PHP code with the privileges of the web server process. The vulnerability was patched in version 4.0.7, released 24 August 2026.
Affected products
- weDevs WP Project Manager ≤ 4.0.6
Timeline
- 2026-08-24: disclosed: Vulnerability published on Patchstack database
- 2026-08-24: patched: Fixed in version 4.0.7