cve recordzero dayexploit reported

CVE-2026-116512

CVSS—

Severitynone

Weakness—

EPSS0.58%48.2th percentile

Exploited1 KEV source

patch window

Called exploited 1 days before disclosure.

Measured from the CVE publication date to the earliest of 1 KEV catalogue that list it.

The life of this vulnerability

CVE reservedOct 26, 2026
CVE publishedOct 31, 20265d
First KEV listingOct 30, 20261d
Last sightingOct 30, 2026same day

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

CISA KEVUS federaldoes not list it
EUVDENISA, European Uniondoes not list it
VulnCheck KEVcommercial researchlisted Oct 30, 2026
CIRCLaggregator, mirrors the abovedoes not list it

Sources1 of 3

Listings differ by—

This rests on a single catalogue. No second catalogue corroborates the claim that it is being exploited. CIRCL is an aggregator and is not counted.

Public exploitation evidence

reported exploitationOct 30, 2026patchstack.com/database/wordpress/plugin/wedevs-project-mana

1 public report collected from VulnCheck and CIRCL, first on Oct 30, 2026. Each links to its original source. We have not verified them.

Description

References

← Back to the CVE Tracker

Our coverage of CVE-2026-116512

CVE-2026-116512Nov 7, 2026high

weDevs wp_project_manager Flaw Exploited Before CVE Publication

The weDevs wp_project_manager plugin was identified as under exploitation one day before the CVE was officially published, leaving users with no patch window.