The Project Manager WordPress plugin vulnerability, affecting a widely used project management plugin, is rated 9.8 out of 10 according to the NVD entry and affects every version up to and including 4.1.1. If this plugin is active on your site, disable it and apply the update as soon as a patched version becomes available.
What is it?
A plugin added to WordPress sites allows, under certain conditions, someone without a password to have the server run their own instructions.
A WordPress site runs on widely used software, extended with add-ons called plugins. The one at issue here, published by wedevs, is used to track projects, tasks, time worked, and Kanban boards, meaning columns where tasks move from “to do” to “done.” According to the NVD entry for CVE-2026-116512, an unauthenticated visitor can cause the server to execute code. Unauthenticated means without an account or password on the site; executing code means getting that machine to carry out one’s own instructions. It’s the cottage you think is locked up tight for winter: the front door is bolted, but a side door is left open and nobody checks who comes through it.
Why is it serious?
The vulnerability opens server access without a password, and the NVD entry rates it 9.8 out of 10.
The score of 9.8 out of 10 comes from CVSS 3.1, an international scale that rates the severity of a vulnerability from 0 to 10; it is assigned by the reporting organization (CNA) per the NVD entry. Whoever gains control of the server can take the site offline, redirect its content, or access what it holds: customer contact details, form submissions, uploaded files. For an organization in Quebec, a leak of personal information is not just an IT headache. The Act respecting the Protection of Personal Information in the Private Sector requires a confidentiality incident register and, in cases set out by law, notification to the Commission d’accès à l’information (Quebec’s privacy regulator). The NVD entry was published on October 31, 2026 and reports no known exploitation as of the time of writing. No patch is listed there, which does not mean none exists: ask the developer or your reseller directly.
Who is affected?
WordPress sites running the wedevs Project Manager plugin, version 4.1.1 or earlier.
The plugin in question is Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker, from developer wedevs. This type of plugin is used by organizations that manage client work online: clinics, accounting firms, carriers, non-profits. For a small or mid-sized business in Quebec or elsewhere in Canada, the practical question is whether this plugin is running on any of its sites, and which version.
How do I check my business?
Check whether the plugin is installed, which version is running, and the state of your backups.
- Have someone open the WordPress dashboard, Plugins section, to see if the module is installed and which version is running: IT provider or web manager.
- Have the site logs, meaning the records where the server notes visits and actions, and recently modified files reviewed: hosting provider or web manager.
- Confirm that a recent backup of the site and its database (where content, accounts, and form submissions are stored) exists, has been tested, and is kept off the server: management, with the provider.
- Ask the plugin’s developer or reseller whether a patched version is available: software vendor.
Scenario
Fictional example: a regional accounting firm whose website serves as a client document portal.
Nobody has touched the site in two years. One Monday morning, the portal displays an unfamiliar page, and the hosting provider suspends it while things get sorted out. Clients who were supposed to drop off their documents start calling, and the firm now has to notify the people whose files were hosted there.
What to do now
- List every company website and the plugins installed on each one.
- Disable the plugin if it is running version 4.1.1 or earlier, and ask the developer or reseller whether a patched version exists.
- Apply the update as soon as it is available, then confirm the site is working normally.
- Have the hosting provider or web manager check the site’s logs and files.
- Keep a recent, tested backup stored off the server, rather than restoring the site as a routine first step.
Project Manager WordPress Plugin Vulnerability: Key Takeaways
The lesson here isn’t about one plugin in particular: the plugins running a site age quietly, without warning, and keeping an up-to-date inventory of them significantly reduces exposure. No provider can guarantee zero risk.
FAQ
We don’t run this plugin, are we in the clear?
For this specific case, yes. But the more useful question is broader: do you know which plugins are running on your site, and who keeps them updated? Have that list drawn up and note who is responsible for it.
Should we take the whole site offline?
In most cases, no. Disabling the affected plugin closes the path described in the NVD entry. That said, any pages or features relying on this plugin will stop working, and the entry gives no indication of how that will affect your operations: check this with your web manager and notify anyone affected. If anything unusual turns up in the logs, suspending the site while files and the database are verified is a reasonable precaution.
We don’t have an IT person, who handles this?
Your web hosting provider is the first point of contact: they have access to the server, the logs, and often the backups. Failing that, the freelancer or agency that built the site. Management’s role is to know who holds the access credentials and to confirm that a recent backup exists.
Sources
- CVE-2026-116512 entry, National Vulnerability Database · NIST, October 31, 2026
- Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations · baseline control checklist
- Commission d’accès à l’information du Québec · obligations, incident register, and notification requirements
Source: NVD (NIST) · https://nvd.nist.gov/vuln/detail/CVE-2026-116512
Article prepared by RISS Canada’s threat monitoring team from the public sources cited above, with the assistance of artificial intelligence tools, then reviewed under our editorial policy.
