EUVD-2026-64802
GHSA-w84f-pwww-634r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Network-accessible plugin endpoint requiring only subscriber auth (PR:L); scope change reflects cross-table DB read beyond plugin boundary; no confirmed write impact justifies I:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions.
AnalysisAI
SQL Injection in WP Project Manager Pro versions 4.0.1 and below allows authenticated subscriber-level users to execute arbitrary SQL queries against the WordPress database, potentially exposing the full database contents including credentials and sensitive user data. The vulnerability carries a CVSS 8.5 (High) with scope change, meaning exploitation reaches beyond the plugin itself to the underlying WordPress database. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid subscriber-level (or higher) WordPress user account on the target site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.5 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) reflects a network-exploitable SQL injection requiring only subscriber-level access - the lowest registered WordPress user role - with low attack complexity and no user interaction required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker self-registers a subscriber account on a WordPress site running WP Project Manager Pro 4.0.1 or earlier - a trivial step on any site with open registration - then sends a crafted authenticated HTTP request containing a SQL injection payload to a vulnerable plugin endpoint. The injected query reads the wp_users table to extract administrator password hashes and email addresses, which are then cracked offline or used to escalate to full WordPress admin access. … |
| Remediation | Update WP Project Manager Pro to a version above 4.0.1 as soon as a patched release is confirmed by the vendor; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wedevs-project-manager-business/vulnerability/wordpress-wp-project-manager-pro-plugin-4-0-1-sql-injection-vulnerability for the confirmed fix version, which was not specified in the available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: conduct inventory of all WordPress instances running WP Project Manager Pro, identify installed versions, and document whether the plugin is business-critical or can be disabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Project Manager Pro
View allSame weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today