WP Project Manager 4.1.2 Fixes an Unauthenticated RCE (CVE-2026-116512), and PDF Invoice for WooCommerce 7.2.0 Closes a Checkout-Triggered Object Injection

Two critical, unauthenticated flaws in WordPress plugins were published at the end of October. Both are scored CVSS 3.1 9.8 and both have fixed releases, so the action for site owners is simple: update now.

WP Project Manager up to 4.1.1: PHP functions called from a REST request (CVE-2026-116512)

The weDevs Project Manager plugin (AI-powered project management, Kanban boards and time tracking) is affected in all versions up to and including 4.1.1. Patchstack published the issue on October 30, 2026 and lists 4.1.2 as the patched version.

According to the published CVE description, the bug is a combination of two things:

• WordPress core runs a REST route's validate_callback before its permission_callback. The plugin's capability check sits in the permission callback, so it never gets a chance to stop the request.
• The validator concatenates the user-supplied id parameter into a pipe-delimited rule string, splits it, and calls each token as a PHP function, with no allowlist.

The result is that an anonymous visitor can make the server call arbitrary PHP functions. Patchstack warns that bugs of this type are typically used in mass-exploit campaigns and has shipped a virtual-patch rule for its customers. At the time of the CVE analysis on October 31, no public exploit had been identified.

To check a site from the command line:

wp plugin list --status=active | grep wedevs-project-manager
wp plugin update wedevs-project-manager

The lesson for plugin developers is worth repeating: in WordPress REST routes, anything in validate_callback or sanitize_callback runs for unauthenticated users too. Never put authorization logic there, and never turn request data into callable names.

PDF Invoice for WooCommerce up to 7.1.1: guest order note reaches unserialize() (CVE-2026-109220)

The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin is affected in all versions up to and including 7.1.1; the vendor has shipped 7.2.0.

The published description says an anonymous visitor can place a checkout through the WooCommerce Store API with a crafted customer_note. That note is carried verbatim into the generated invoice HTML and ends up in unserialize() inside the bundled mPDF library.

Two conditions narrow the real-world risk:

• On a default install the trigger only fires when an offline payment method such as Direct Bank Transfer (BACS) or cheque is enabled, because the resulting "on-hold" order status is what starts invoice generation.
• Object injection turns into code execution only if a usable PHP gadget chain is loadable on the site, which depends on the other plugins and libraries installed.

Shops that accept bank transfers should treat this as urgent anyway: the attack needs no account and no user interaction.

What to do

1. Update WP Project Manager to 4.1.2 or later, and PDF Invoice for WooCommerce to 7.2.0 or later.
2. If you can't update right away, deactivate the plugin until you can.
3. Review recent orders with unusual customer notes, and check wp-content for unexpected new PHP files.
4. Keep in mind that these are plugin fixes. They don't replace the PHP runtime updates (8.5.12, 8.4.27, 8.3.36, 8.2.35) released on October 21.

Sources

• Patchstack: WP Project Manager <= 4.1.1 Remote Code Execution
• vuln.today CVE archive for October 31, 2026

---

If a site is stuck on an old plugin or PHP version because updating breaks something, RescuePHP can help: we audit legacy WordPress and WooCommerce installs, apply or backport security fixes, and check for signs of compromise.