Low Severity
CVE-2026-116512
Published: Nov 7, 2026
# CVE-2026-116512 - Project Manager RCE (Cyp1337 Edition)
Unauthenticated Remote Code Execution exploit for the **weDevs Project Manager** WordPress plugin versions **<= 4.1.1**.
**Author:** Cyp1337
**GitHub:** [https://github.com/0xCyp1337](https://github.com/0xCyp1337)
**Telegram:** [@kingepepp](https://t.me/kingepepp)
---
## 🔍 Vulnerability Details
- **CVE ID:** CVE-2026-116512
- **Affected Software:** weDevs Project Manager (WordPress Plugin)
- **Affected Versions:** <= 4.1.1
- **Vulnerability Type:** Unauthenticated Remote Code Execution (RCE)
- **Root Cause:** The plugin concatenates unsanitized user input from the `id` parameter into a validation rule (`'title' => 'required|pm_unique:Project,title,'.$id`). The validation mechanism splits rules by `|` and dynamically calls functions. If a prefixed function doesn't exist, it falls back to the raw function name (e.g., `system`, `exec`). This is exploitable unauthenticated because the WP REST API runs `validate_callback` before `permission_callback`.
---
## ✨ Features
- **Single & Mass Exploitation:** Target one host or scan a list of targets.
- **Unauthenticated RCE:** No login required.
- **Multi-threaded:** Fast mass scanning.
- **Auto Shell Upload:** Automatically deploys a base64-encoded, GIF89a-wrapped PHP shell.
- **Proof of Write Access:** Drops a `.txt` proof file to verify write permissions.
- **Custom Commands:** Execute arbitrary commands instead of the default `id -u`.
- **Real-time Output:** Colorful progress bar with live target display and automatic result logging.
- **Auto-save Results:** Outputs are instantly saved to `rce.txt`, `up.txt`, and `shells.txt`.
---
## ⚙️ Requirements
- Python 3.6+
- `requests` library
Install dependencies:
```bash
pip install requests