CVE-2026-78262 CRITICAL

CVE-2026-78262: WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability

Vendor Wedevs
Product WP Project Manager
Weakness CWE-502 · Unsafe deserialization
Published August 24, 2026
Last update August 27, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.

Explanation of Vulnerability in Simple Terms

02Summary

WP Project Manager versions up to 4.0.6 contain a deserialization vulnerability that allows unauthenticated attackers to run arbitrary PHP code on the site. The plugin unsafely processes serialized data without validation, enabling remote code execution. All sites running affected versions should update immediately.

What an attacker can do

03Attacker Capabilities

Run arbitrary PHP code on the site without authentication.

Potential impact on your site

04Site Impact

Complete site compromise: attacker can read/modify data, create admin accounts, or take the site offline.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 24, 2026 CVE published
August 27, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57738 WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability CVE-2026-28139 WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability CVE-2026-73341 WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability CVE-2026-32465 WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability CVE-2026-57713 WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability