CVE Catalog
CVE-2026-78262
CriticalCVSS 9.8Summary
Unauthenticated PHP Object Injection in WP Project Manager versions up to 4.0.6.
Risk Assessment
An attacker can exploit this to achieve remote code execution or data manipulation, potentially leading to WordPress site takeover.
Recommendation
Update WP Project Manager plugin to the latest patched version. Restrict access to forms and monitor logs for suspicious activity.
Original NVD description (English source)
Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.