A critical security vulnerability affecting the weDevs WP Project Manager plugin for WordPress has been identified and assigned the identifier CVE-2026-116512. Security researchers have reported that this flaw was actively exploited in the wild one day before the official publication of the CVE record.
The vulnerability was officially reserved on October 26, 2026, and subsequently published on October 31, 2026. According to data tracked by security intelligence services, the first evidence of exploitation surfaced on October 30, 2026. This timeline indicates that malicious actors were leveraging the flaw in active campaigns prior to the security community receiving formal notification or technical details regarding the vulnerability.
The claim of exploitation is currently based on a single source of intelligence. While the vulnerability has been documented by research entities, it has not yet been added to the U.S. Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog, nor has it been listed by the European Union Agency for Cybersecurity (ENISA) database. The classification of this incident as "actively exploited" relies on external commercial research tracking, which identified the activity on October 30.
The vulnerability is linked to the weDevs WP Project Manager plugin, a tool widely used for task and project management within the WordPress ecosystem. While specific technical details regarding the nature of the exploit—such as the exact attack vector or the specific code path affected—remain limited, the emergence of exploitation activity prior to the public disclosure of the CVE record highlights the ongoing risk of zero-day or near-zero-day attacks against popular web plugins.
Users of the WP Project Manager plugin are advised to review their installations and ensure they are running the most current version available from the vendor. Because the vulnerability was identified and tracked in late October 2026, administrators should verify that their plugin version includes all security patches released on or after that date to mitigate the risk of unauthorized access or exploitation.
As of the current reporting, there is no corroborating evidence from multiple independent threat intelligence aggregators to confirm the scale or specific targets of the exploitation. The incident serves as a reminder of the importance of maintaining up-to-date software environments, as attackers frequently monitor for newly reserved CVEs to develop and deploy exploits before official patches are fully understood or widely applied by the user base.
