CVE-2026-78470: WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection
The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. Sites that allow untrusted users to register or otherwise obtain Subscriber accounts have a more realistic exposure path.
What could an attacker gain through exploitation?
The SQL injection can be used to append queries to existing database queries and extract sensitive information from the WordPress database. The provided impact information indicates high confidentiality impact, with no stated integrity or availability impact.
Which installations are affected?
WP Project Manager Pro versions up to and including 4.0.1 are affected. Exploitation does not require user interaction, but it does require authenticated access.