{"metadata": {"vulnerability": "CVE-2026-116512", "count": 22, "kinds": {"milestone": 4, "sighting": 8, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-26T13:19:11.742Z", "date_only": false, "value": "2026-10-26T13:19:11.742Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-116512", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-26T13:32:58Z", "date_only": false, "value": "2026-10-26T13:32:58.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-116512", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-30T19:25:37Z", "date_only": false, "value": "2026-10-30T19:25:37.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-116512", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-31T07:46:51.642Z", "date_only": false, "value": "2026-10-31T07:46:51.642Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-116512", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-31T07:46:51.642Z", "date_only": false, "value": "2026-10-31T07:46:51.642Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-116512", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-31T07:57:57.515Z", "date_only": false, "value": "2026-10-31T07:57:57.515532Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117534456347393743", "record": "CVE-2026-116512", "field": "creation_timestamp", "uuid": "19e5e7c5-d2c9-497a-943e-1d0c16f1c3e7", "content": "CVE-2026-116512 Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection The Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP function with no allowlist check. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable by unauthenticated attackers because WordPress core executes the route argument's validate_callback inside WP_REST_Server::dispatch() before the route's permission_callback is invoked, meaning the Project_Manage_Capability authorization gate is never reached on the vulnerable code path.\nhttps://www.cve.org/CVERecord?id=CVE-2026-116512https://www.wordfence.com/threat-intel/vulnerabilities/id/d3e300b3-39cc-4681-a8e8-02d9743f97ff?source=cvehttps://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/core/Validator/Abstract_Validator.php#L156https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/src/Project/Validators/Update_Project.php#L25https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/core/Router/WP_Router.php#L429https://plugins.trac.wordpress.org/changeset/3772103/wedevs-project-manager/trunk/core/Validator/Abstract_Validator.php#wordpress #wedevs #ProjectManager\u2013AIPoweredProjectManagement,TaskManagement,KanbanBoard&TimeTracker#CVE_2026_116512#bot", "url": "https://infosec.exchange/users/cve/statuses/117534456347393743"}, {"timestamp": "2026-10-31T08:16:48Z", "date_only": false, "value": "2026-10-31T08:16:48Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-3J45-2638-6G5H", "record": "GHSA-3J45-2638-6G5H", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-31T08:16:48.603Z", "date_only": false, "value": "2026-10-31T08:16:48.603", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-116512", "record": "FKIE_CVE-2026-116512", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-31T09:31:13Z", "date_only": false, "value": "2026-10-31T09:31:13Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3J45-2638-6G5H", "record": "GHSA-3J45-2638-6G5H", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-31T09:31:13Z", "date_only": false, "value": "2026-10-31T09:31:13Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3J45-2638-6G5H", "record": "GHSA-3J45-2638-6G5H", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-31T10:07:27.885Z", "date_only": false, "value": "2026-10-31T10:07:27.885676Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mz62dxkxdd2v", "record": "CVE-2026-116512", "field": "creation_timestamp", "uuid": "7d23462b-b361-4738-93f0-6a181282b564", "content": "\ud83d\udea8 CVE-2026-116512 \u2014 CVSS 9.8 CRITICAL\n\nThe Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin fo...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-116512\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mz62dxkxdd2v"}, {"timestamp": "2026-10-31T11:39:21Z", "date_only": false, "value": "2026-10-31T11:39:21.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/wy0GJdrOV_XNmjpvnmNj3t-DUubNRF-O-jlkFBtHRWqgLoE", "record": "CVE-2026-116512", "field": "creation_timestamp", "uuid": "cc8cf254-98f0-48e1-94b9-d1c3cccfec58"}, {"timestamp": "2026-10-31T14:45:57.412Z", "date_only": false, "value": "2026-10-31T14:45:57.412637Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mz6jwaduaw2l", "record": "CVE-2026-116512", "field": "creation_timestamp", "uuid": "418c7f8c-8240-40ab-90e8-efd480eff03a", "content": "\ud83d\udd34 CVE-2026-116512 - Critical (9.8)\n\nThe Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Track...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-116512/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mz6jwaduaw2l"}, {"timestamp": "2026-10-31T18:30:54.736Z", "date_only": false, "value": "2026-10-31T18:30:54.736791Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/fc-vulns.bsky.social/post/3mz6wiid5oq2f", "record": "CVE-2026-116512", "field": "creation_timestamp", "uuid": "4d278058-4004-4057-a372-499b1cb0d8d9", "content": "Watch this critical one.\n\nCVE-2026-116512 published 2026-10-31 \u2014 CVSS 9.8.\n\nWordPress Project Manager plugin \u22644.1.1: unauth RCE via unsanitized 'id' parameter invoked as a dynamic PHP function.\n\nhttps://www.fc-vulns.com/cve/CVE-2026-116512/\n\n#fcvulns #Wordpress", "url": "https://bsky.app/profile/fc-vulns.bsky.social/post/3mz6wiid5oq2f"}, {"timestamp": "2026-11-01T01:40:05.383Z", "date_only": false, "value": "2026-11-01T01:40:05.383117Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mz7ohwqtzu2w", "record": "CVE-2026-116512", "field": "creation_timestamp", "uuid": "025b4fee-76d6-4fb3-8b9c-9b3aaec660eb", "content": "CVE-2026-116512 - project manager \u2013 ai powered project management, task management, kanban board & time tracker\nThe Project Manager \u2013 AI Powered Project Management plugin for WordPress can let anyone on the internet\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#wedevs #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mz7ohwqtzu2w"}, {"timestamp": "2026-11-01T21:04:07Z", "date_only": false, "value": "2026-11-01T21:04:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/108564", "record": "CVE-2026-116512", "field": "creation_timestamp", "uuid": "ba005134-b80b-4dbe-8140-63bae869d797", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-116512\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BabyMushr00w\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-01 21:02:34\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for CVE-2026-116512 - weDevs Project Manager <= 4.1.1 Unauthenticated RCE. For educational and authorized security testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/108564", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-02T00:00:14.247Z", "date_only": false, "value": "2026-11-02T00:00:14.247561Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mzbze763cd2k", "record": "CVE-2026-116512", "field": "creation_timestamp", "uuid": "1a657712-4c33-49a3-99b1-66e930df0bf8", "content": "CVE-2026-116512. CVSS 9.8. Remote code execution in Project Manager plugin\u2014no auth needed. Any visitor executes arbitrary code. Your server. Your files. Your database.\n\nUpdate to 4.1.1 now.\n\nScan your WordPress site: pulse-wp.com\n#WordPress #RCE #CyberSecurity", "url": "https://bsky.app/profile/pulse-wp.com/post/3mzbze763cd2k"}, {"timestamp": "2026-11-02T14:51:17.934Z", "date_only": false, "value": "2026-11-02T14:51:17.934940Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-116512", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-02T14:51:17.934Z", "date_only": false, "value": "2026-11-02T14:51:17.934940Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-116512", "record": "FKIE_CVE-2026-116512", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-02T14:51:27.976Z", "date_only": false, "value": "2026-11-02T14:51:27.976Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-116512", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-02T14:51:27.976Z", "date_only": false, "value": "2026-11-02T14:51:27.976Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-116512", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-02T16:19:19.997Z", "date_only": false, "value": "2026-11-02T16:19:19.997", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-116512", "record": "FKIE_CVE-2026-116512", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-03T10:37:01.744Z", "anchors": {"origin": {"timestamp": "2026-10-31T07:46:51.642Z", "date_only": false, "value": "2026-10-31T07:46:51.642Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-116512", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-31T07:46:51.642Z", "date_only": false, "value": "2026-10-31T07:46:51.642Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-116512", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-11-01T21:04:07Z", "date_only": false, "value": "2026-11-01T21:04:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/108564", "record": "CVE-2026-116512", "field": "creation_timestamp", "uuid": "ba005134-b80b-4dbe-8140-63bae869d797", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-116512\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BabyMushr00w\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-01 21:02:34\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for CVE-2026-116512 - weDevs Project Manager <= 4.1.1 Unauthenticated RCE. For educational and authorized security testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/108564", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 134235.358, "hours": 37.287599444444446, "days": 1.553649976851852, "min_seconds": 134235.358, "max_seconds": 134235.358, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-31T07:46:51.642Z", "date_only": false, "value": "2026-10-31T07:46:51.642Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-116512", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-01T21:04:07Z", "date_only": false, "value": "2026-11-01T21:04:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/108564", "record": "CVE-2026-116512", "field": "creation_timestamp", "uuid": "ba005134-b80b-4dbe-8140-63bae869d797", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-116512\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BabyMushr00w\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-01 21:02:34\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for CVE-2026-116512 - weDevs Project Manager <= 4.1.1 Unauthenticated RCE. For educational and authorized security testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/108564", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 269410.102421, "hours": 74.83613956138889, "days": 3.118172481724537, "min_seconds": 269410.102421, "max_seconds": 269410.102421, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-31T07:46:51.642Z", "date_only": false, "value": "2026-10-31T07:46:51.642Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-116512", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-03T10:37:01.744Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 135174.744421, "hours": 37.548540116944444, "days": 1.5645225048726854, "min_seconds": 135174.744421, "max_seconds": 135174.744421, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-01T21:04:07Z", "date_only": false, "value": "2026-11-01T21:04:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/108564", "record": "CVE-2026-116512", "field": "creation_timestamp", "uuid": "ba005134-b80b-4dbe-8140-63bae869d797", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-116512\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BabyMushr00w\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-01 21:02:34\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for CVE-2026-116512 - weDevs Project Manager <= 4.1.1 Unauthenticated RCE. For educational and authorized security testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/108564", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-03T10:37:01.744Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}