WordPress Plugin Remote Code Execution via Unsanitized Parameters

The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP function with no allowlist check. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable by unauthenticated attackers because WordPress core executes the route argument's validate_callback inside WP_REST_Server::dispatch() before the route's permission_callback is invoked, meaning the Project_Manage_Capability authorization gate is never reached on the vulnerable code path.

Casky was already ahead

This CVE exploits attack patterns that Casky's 447matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Project Manager plugin for WordPress contains a critical Remote Code Execution vulnerability (CVSS 9.8) affecting all versions through 4.1.1. An unauthenticated attacker can exploit an unsanitized 'id' parameter that gets concatenated into a pipe-delimited validation rule string. This string is then split and each token is invoked as a dynamic PHP function without allowlist validation, enabling arbitrary code execution on vulnerable WordPress installations. This vulnerability is particularly dangerous because it requires no authentication, has a CVSS score in the critical range, and affects a widely-used project management plugin that may be installed across thousands of WordPress sites managing sensitive business operations.

Casky's 447 matching skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this CVE across three key MITRE ATT&CK tactics: Initial Access (TA0001), Persistence (TA0043), and Execution (TA0002). Practitioners using Casky would identify suspicious findings including: unauthenticated HTTP requests targeting the plugin's vulnerable endpoint with specially-crafted 'id' parameters containing PHP function names; unexpected dynamic function invocations in application logs that bypass normal execution flow; and post-exploitation indicators such as webshell uploads or privilege escalation attempts following successful code execution. The platform's skill mapping would correlate these technical indicators with known exploit patterns, enabling security teams to distinguish this specific vulnerability from other parameter injection attacks and prioritize remediation based on exposure risk.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

447 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-116512.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-116512

Casky has 447 skills that investigate the attack patterns behind CVE-2026-116512. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn