CVE-2026-32478 HIGH

CVE-2026-32478: WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability

Vendor Wedevs Pte. Ltd
Product WP Project Manager Pro
Weakness CWE-89 · SQLi
Published August 24, 2026
Last update August 24, 2026
View on NVD All CVEs

CVSS base score

8.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

What the vulnerability does

01Description

Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions.

Explanation of Vulnerability in Simple Terms

02Summary

WP Project Manager Pro versions up to 4.0.1 contain a SQL injection vulnerability in a database query that accepts user input without proper sanitization. An authenticated user with low privileges can craft a malicious request to extract sensitive data from the site's database or degrade performance. The vulnerability affects the entire site scope due to database access.

What an attacker can do

03Attacker Capabilities

Extract sensitive data from the site database or cause performance degradation through SQL injection.

Potential impact on your site

04Site Impact

Unauthorized access to database contents including user credentials, posts, and configuration data; potential site slowdown or instability.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account (e.g., subscriber or contributor role) on the WordPress site.

Key dates

06Disclosure timeline

August 24, 2026 CVE published