WP Project Manager Pro CVE-2026-32478

Exploitation requires a valid subscriber-level (or higher) WordPress user account on the target site. Subscriber is the lowest registered user role in WordPress; sites with open user registration - the default on many WordPress installations - allow any unauthenticated internet user to self-create this account, effectively lowering the barrier to near-unauthenticated. No special plugin feature, configuration setting, or non-default deployment mode is required beyond having WP Project Manager Pro active at version <= 4.0.1. What limits exploitation: the attacker must possess at minimum a valid WordPress login for the target site, and sites that have explicitly disabled user registration with no other account-creation pathway reduce the exposed population significantly. The CVSS I:N suggests write capability is not confirmed from available data, limiting confirmed impact to data exfiltration.

The CVSS 8.5 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) reflects a network-exploitable SQL injection requiring only subscriber-level access - the lowest registered WordPress user role - with low attack complexity and no user interaction required. The scope change paired with High confidentiality impact suggests the injection enables full cross-table database reads, including administrator password hashes and any sensitive data stored by co-installed plugins. EPSS data was not provided, so exploitation probability cannot be numerically quantified, and no KEV listing means active exploitation is not confirmed. However, the extremely low privilege barrier - many WordPress sites enable open user registration by default, allowing any anonymous internet user to obtain a subscriber account - meaningfully elevates real-world risk beyond what the PR:L metric alone suggests. The integrity impact of N in the provided CVSS vector warrants verification: depending on the MySQL user permissions and whether stacked queries are supported, read-only SQLi sometimes permits writes in practice. The absence of a confirmed patched version number in available intelligence is a gap that defenders must close by checking the Patchstack advisory directly.

An attacker self-registers a subscriber account on a WordPress site running WP Project Manager Pro 4.0.1 or earlier - a trivial step on any site with open registration - then sends a crafted authenticated HTTP request containing a SQL injection payload to a vulnerable plugin endpoint. The injected query reads the wp_users table to extract administrator password hashes and email addresses, which are then cracked offline or used to escalate to full WordPress admin access. No public exploit code has been identified at time of analysis, but the low complexity and broad availability of WordPress SQLi techniques make independent development straightforward.