CVE-2026-78262: WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability
Published Aug 24, 2026
·Updated
Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.
Affected Software
1 affected component
WordPress WP Project Manager<=4.0.6
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP Project Manager pluginto a version that resolves this vulnerability.Fixed in 4.0.7
Event History
Aug 24, 2026
CVE Published
via MITRE·09:31 PM
Data Sourced
via MITRE·09:31 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations should be considered exposed?
WordPress sites running WP Project Manager version 4.0.6 or earlier should be considered affected.
2
Does exploitation require an authenticated WordPress account or user interaction?
No. The vulnerability is described as unauthenticated, and the supplied severity vector indicates no privileges or user interaction are required.