EUVD-2026-65299
GHSA-v8gv-47g7-xcwv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable endpoint, low complexity; Subscriber authentication required (PR:L); read-only database extraction yields C:H with I:N and A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in WP Project Manager Pro (WordPress plugin by weDevs, all versions through 4.0.1) allows authenticated attackers holding Subscriber-level access or higher to append arbitrary SQL clauses to existing plugin queries, enabling extraction of sensitive data from the WordPress database. The CVSS vector confirms high confidentiality impact with no integrity or availability consequences - the primary risk is database read access, potentially exposing user credentials and application data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at minimum Subscriber-level access - the lowest default WordPress role, obtainable via self-registration on sites with open user registration enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 6.5, reflecting low-complexity network exploitation requiring Subscriber-level authentication, with high confidentiality impact but no integrity or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free Subscriber account on a target WordPress site running the vulnerable plugin version, then submits HTTP requests to the affected plugin endpoint with SQL payloads embedded in the vulnerable parameter - for example, appending a UNION SELECT statement to extract rows from the wp_users table. The low complexity and absence of required user interaction suggest the attack can be scripted and repeated across multiple targets. … |
| Remediation | Update WP Project Manager Pro to a version beyond 4.0.1 as soon as the vendor releases a patched build - no specific fix version number is confirmed in the available intelligence at time of analysis, so administrators should monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/df6f4e7a-3cec-4964-ad3a-c3c2d549f8a5?source=cve and the weDevs product page at https://wedevs.com/wp-project-manager-pro/ for a patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Project Manager Pro
View allSame weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today