EUVD-2026-65169
GHSA-xgwv-wp33-rjpx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running WP Project Manager <=4.0.6
-
DeliverySend HTTP request with serialized PHP object
-
ExploitTrigger unserialize() object injection
-
ExecutionInvoke magic method gadget chain
-
ImpactAchieve code execution or data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected weDevs WP Project Manager plugin (version <= 4.0.6) must be installed and active on the target WordPress site, and the vulnerable deserialization endpoint must be network-reachable. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the description's 'Unauthenticated' qualifier, no authentication and no user interaction are required, so default installations of the vulnerable plugin are exploitable remotely. The principal limiting factor not captured by the CVSS score is that escalation beyond basic object injection to full code execution depends on a reachable PHP POP gadget chain in the plugin, WordPress core, or a loaded library - availability of such a chain is not confirmed in the provided data and constrains realistic impact. |
| Impact | The signals here are strong but partially unverified. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical) indicates a network-reachable, low-complexity, unauthenticated attack with high impact across all three dimensions - the description's 'Unauthenticated' qualifier is consistent with PR:N. Because it runs inside WordPress, a very widely deployed platform, and requires no authentication, this warrants prompt patching where the plugin is installed. However, real-world exploitability of a PHP object injection bug depends on the availability of a reachable POP gadget chain, which is not documented in the provided data; a raw unserialize() sink with no gadget yields lower practical impact than the 9.8 suggests. No EPSS score, no SSVC decision data, and no POC or KEV status were supplied, so exploitation probability cannot be quantified from this input - there is no public exploit identified at time of analysis and it is not in CISA KEV. Net assessment: treat as high priority for any site running WP Project Manager <= 4.0.6, while recognizing that whether it reaches full RCE versus limited object injection is unconfirmed from available data. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP request to a public WordPress site running WP Project Manager <= 4.0.6, embedding a serialized PHP object in a parameter that the plugin passes to unserialize(). When deserialized, the forged object triggers a magic method that drives an available gadget chain, potentially leading to file manipulation, data disclosure, or code execution. No authentication or user interaction is required per the CVSS vector; no public POC is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 24, 2026
Insecure deserialization in weDevs WP Project Manager (WordPress plugin) versions up to and including 4.0.6 allows remote unauthenticated attackers to inject crafted PHP objects (CWE-502) into the application. With CVSS:3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N) and full confidentiality, integrity, and availability impact, successful exploitation can lead to arbitrary object instantiation and, given a suitable POP gadget chain in the plugin or WordPress core, remote code execution or data compromise. Reported by Patchstack and tracked as ENISA EUVD-2026-65169; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Update WP Project Manager to a release newer than 4.0.6 as soon as one is confirmed by weDevs; the input data specifies affected versions as <= 4.0.6 but does not include an exact fixed version, so no vendor-released patch version is independently confirmed at time of analysis - verify the fixed version against the vendor changelog and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wedevs-project-manager/vulnerability/wordpress-wp-project-manager-plugin-4-0-6-php-object-injection-vulnerability?_s_id=cve). Until a confirmed patched build is applied, compensating controls include: deploying a WordPress WAF or virtual patch (Patchstack offers one for this entry) to filter serialized-object payloads reaching the plugin's endpoints; restricting or disabling the plugin if it is not business-critical (trade-off: loss of project-management functionality); and restricting access to the affected endpoints via IP allowlisting or authentication at the web-server layer where feasible (trade-off: may block legitimate remote users). Monitor request logs for serialized PHP patterns (e.g., 'O:' object markers) as a detection measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a PHP Object Injection flaw, the class of bug described by CWE-502 (Deserialization of Untrusted Data). It occurs when an application passes attacker-controllable input to PHP's unserialize() without validation, letting an attacker forge serialized object structures. When such an object is reconstituted, PHP magic methods (__wakeup, __destruct, __toString, etc.) execute automatically; if a usable 'POP gadget chain' exists in the plugin, WordPress core, or a bundled library, this can be escalated to file writes, SQL injection, or code execution. The affected component is identified by CPE cpe:2.3:a:wedevs:wp_project_manager, i.e., the weDevs WP Project Manager plugin for WordPress, a project/task management extension that runs inside the PHP-based WordPress request lifecycle.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization (PR:N/AV:N/AC:L/UI:N); object injection with a viable gadget chain can compromise confidentiality, integrity, and availability, so C/I/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.
Articles & Coverage 1
Executive ViewAI
A critical remote code execution vulnerability in weDevs WP Project Manager plugin (all versions through 4.0.6) exposes WordPress sites to unauthenticated full system compromise via insecure deserialization. No vendor patch is currently available, making immediate plugin removal the only effective mitigation. Organizations relying on this plugin face data breach, malware infection, or complete site takeover until a replacement solution is deployed.
Immediately disable and deactivate the plugin on all production systems. Deploy Web Application Firewall rules to block HTTP requests containing serialized PHP object patterns. Restrict WordPress administrative console access to approved IP ranges only. Enable comprehensive application logging and real-time alerting for failed deserialization attempts or unusual PHP execution patterns. Isolate affected WordPress instances from sensitive internal systems and databases pending plugin replacement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB