weDevs Project Manager EUVD-2026-114653

No special conditions - remote unauthenticated exploitation is possible against default configurations of the weDevs Project Manager plugin for WordPress in all versions up to and including 4.1.1. The attacker must reach the affected REST route and supply a crafted 'id' parameter; exploitation does not require authentication because WordPress core executes the route's validate_callback inside WP_REST_Server::dispatch() before the permission_callback, bypassing the Project_Manage_Capability gate. The only practical limiting factors are that the target must be running an affected version (≤4.1.1) with the plugin's REST route reachable; no user interaction, no privileges, and no non-default setting are required per the described code path.

All available signals align toward high real-world risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, and the description substantiates the PR:N claim with a concrete mechanism: WordPress core invokes a route's validate_callback inside WP_REST_Server::dispatch() before the permission_callback runs, so the Project_Manage_Capability authorization gate is never reached on the vulnerable path - the unauthenticated rating is therefore mechanistically supported rather than merely asserted. The vuln.today Decision label is act_now and the finding is attributed to Wordfence, a credible WordPress-security source. Countervailing data: there is no CISA KEV listing and no EPSS score in the input, so there is no evidence yet of active or widespread exploitation - the urgency here rests on the act_now decision label and the critical, unauthenticated RCE nature of the flaw, not on observed in-the-wild activity. No working exploit code is referenced (the links are the Wordfence advisory and plugin source lines, not a PoC). Net: this is a genuine high priority because of unauthenticated RCE with a credibly-described auth bypass, but the exploitation-probability picture is incomplete because EPSS and KEV data were not provided.

A remote attacker with no account sends a crafted REST API request to the plugin's project-update route, placing a malicious value in the 'id' parameter. Because WordPress runs the route's validate_callback before any permission check, the attacker-controlled token is split from the pipe-delimited validation-rule string and invoked as a dynamic PHP function, executing attacker-chosen code on the server. No public working exploit code is referenced in the available data, though the Wordfence advisory and vulnerable source lines are published.