Wp Project Manager Pro
Monthly
SQL Injection in WP Project Manager Pro versions 4.0.1 and below allows authenticated subscriber-level users to execute arbitrary SQL queries against the WordPress database, potentially exposing the full database contents including credentials and sensitive user data. The vulnerability carries a CVSS 8.5 (High) with scope change, meaning exploitation reaches beyond the plugin itself to the underlying WordPress database. Reported by Patchstack and tracked as EUVD-2026-64802; no active exploitation (CISA KEV) has been confirmed, and no public exploit code has been identified at time of analysis.
SQL injection in WP Project Manager Pro (WordPress plugin by weDevs, all versions through 4.0.1) allows authenticated attackers holding Subscriber-level access or higher to append arbitrary SQL clauses to existing plugin queries, enabling extraction of sensitive data from the WordPress database. The CVSS vector confirms high confidentiality impact with no integrity or availability consequences - the primary risk is database read access, potentially exposing user credentials and application data. No public exploit code or active exploitation has been identified at time of analysis, though the low privilege requirement (any registered WordPress user) meaningfully broadens the viable attacker pool.
SQL Injection in WP Project Manager Pro versions 4.0.1 and below allows authenticated subscriber-level users to execute arbitrary SQL queries against the WordPress database, potentially exposing the full database contents including credentials and sensitive user data. The vulnerability carries a CVSS 8.5 (High) with scope change, meaning exploitation reaches beyond the plugin itself to the underlying WordPress database. Reported by Patchstack and tracked as EUVD-2026-64802; no active exploitation (CISA KEV) has been confirmed, and no public exploit code has been identified at time of analysis.
SQL injection in WP Project Manager Pro (WordPress plugin by weDevs, all versions through 4.0.1) allows authenticated attackers holding Subscriber-level access or higher to append arbitrary SQL clauses to existing plugin queries, enabling extraction of sensitive data from the WordPress database. The CVSS vector confirms high confidentiality impact with no integrity or availability consequences - the primary risk is database read access, potentially exposing user credentials and application data. No public exploit code or active exploitation has been identified at time of analysis, though the low privilege requirement (any registered WordPress user) meaningfully broadens the viable attacker pool.