Project Manager Ai Powered Project Management Task Management Kanban Board Time Tracker
Monthly
Unauthenticated remote code execution in the weDevs Project Manager plugin for WordPress through version 4.1.1 lets remote attackers invoke arbitrary PHP functions by supplying a crafted 'id' parameter to the plugin's REST route. WordPress core runs the route's validate_callback before its permission_callback, so the plugin's Project_Manage_Capability authorization gate is bypassed; the validator concatenates the 'id' value into a pipe-delimited rule string, splits it, and calls each token as a dynamic PHP function without an allowlist. CVSS 3.1 scores 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the supplied decision label is act_now, and no public exploit identified at time of analysis in the provided intelligence.
Unauthenticated remote code execution in the weDevs Project Manager plugin for WordPress through version 4.1.1 lets remote attackers invoke arbitrary PHP functions by supplying a crafted 'id' parameter to the plugin's REST route. WordPress core runs the route's validate_callback before its permission_callback, so the plugin's Project_Manage_Capability authorization gate is bypassed; the validator concatenates the 'id' value into a pipe-delimited rule string, splits it, and calls each token as a dynamic PHP function without an allowlist. CVSS 3.1 scores 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the supplied decision label is act_now, and no public exploit identified at time of analysis in the provided intelligence.