CVE-2026-32478: WP Project Manager Pro SQL Injection Flaw

CVE-2026-32478 Overview

CVE-2026-32478 is a SQL injection vulnerability in the WP Project Manager Pro plugin for WordPress, affecting versions 4.0.1 and earlier. The flaw allows an authenticated user with subscriber-level privileges to inject arbitrary SQL statements through plugin input parameters. Because subscriber accounts are commonly available through self-registration on many WordPress sites, the barrier to exploitation is minimal. Successful exploitation exposes the WordPress database to unauthorized reads and can disrupt database availability. The issue is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
An authenticated subscriber can execute arbitrary SQL queries against the WordPress database, exposing sensitive site data and impacting database availability.

Affected Products

WP Project Manager Pro (weDevs Project Manager Business) plugin for WordPress
All versions up to and including 4.0.1
WordPress sites permitting user registration at subscriber role or higher

Discovery Timeline

2026-08-24 - CVE-2026-32478 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-32478

Vulnerability Analysis

The vulnerability resides in WP Project Manager Pro version 4.0.1 and earlier. Plugin code accepts request parameters from authenticated users and incorporates them into SQL queries without adequate parameterization or escaping. A subscriber-level account is sufficient to reach the affected code path, which is unusual for plugin functionality typically expected to require elevated privileges. Attackers can leverage the injection to enumerate database contents, exfiltrate WordPress user records, and read session tokens or password hashes stored in wp_users and wp_usermeta. The scope change indicated by the CVSS vector reflects that impact extends beyond the plugin's own data boundary to the entire WordPress database. Impact is rated high for confidentiality and low for availability, with no direct integrity impact.

Root Cause

The root cause is improper neutralization of special elements within an SQL command [CWE-89]. Plugin request handlers pass user-controlled values into database queries without using WordPress's $wpdb->prepare() API or equivalent parameterized query mechanisms. Input filtering is either missing or insufficient to strip SQL metacharacters before query construction.

Attack Vector

Exploitation is performed over the network against the WordPress site. The attacker authenticates using any account with subscriber capabilities, then submits a crafted request to a vulnerable plugin endpoint. Injected SQL payloads are concatenated into the backend query, causing the database to execute attacker-supplied logic. Because WordPress subscriber registration is frequently open by default on membership, e-commerce, and community sites, gaining the required privilege level is often trivial.

No verified public exploit code is available at time of publication. See the Patchstack advisory for vendor-side technical context.

Detection Methods for CVE-2026-32478

Indicators of Compromise

Web server access logs showing subscriber-authenticated requests to WP Project Manager Pro endpoints containing SQL metacharacters such as UNION, SELECT, SLEEP(, single quotes, or URL-encoded equivalents (%27, %20UNION%20).
Unexpected outbound queries or long-running queries in MySQL slow query logs originating from the wp-admin/admin-ajax.php handler used by the plugin.
Sudden creation of new administrative WordPress accounts or modifications to entries in wp_users and wp_usermeta following subscriber activity.

Detection Strategies

Deploy WordPress-aware web application firewall rules that inspect plugin request parameters for SQL injection patterns and block known payload signatures.
Correlate low-privilege user sessions with database-heavy request patterns, especially requests targeting WP Project Manager Pro AJAX actions.
Review WordPress audit logs for role changes, privilege escalations, or password resets following subscriber-authenticated traffic.

Monitoring Recommendations

Enable MySQL general query logging or slow query logging on affected sites during triage to capture injected statements.
Forward WordPress and web server logs to a centralized analytics platform to correlate subscriber activity with database anomalies.
Track newly registered subscriber accounts and flag those making immediate requests to plugin admin endpoints.

How to Mitigate CVE-2026-32478

Immediate Actions Required

Update WP Project Manager Pro to a version later than 4.0.1 as soon as the vendor releases a patched build.
Disable open user registration on WordPress until a fix is applied, or restrict the default new-user role to remove access to plugin endpoints.
Audit existing subscriber accounts and revoke or reset any that were created from suspicious IP addresses or during recent unexplained activity.
Rotate WordPress administrator passwords, secret keys in wp-config.php, and API credentials that could have been exposed through database reads.

Patch Information

Refer to the Patchstack advisory for WP Project Manager Pro for the authoritative patched version and vendor guidance. Apply the fixed release from the weDevs vendor portal after verifying build integrity.

Workarounds

Deactivate WP Project Manager Pro until the plugin can be updated to a fixed release.
Deploy a WordPress-focused WAF ruleset with virtual patching for CVE-2026-32478 to block SQL injection payloads targeting the plugin.
Restrict access to the plugin's AJAX endpoints via server-level access control lists, allowing only trusted staff IP ranges.

bash

# Example: temporarily deactivate the plugin via WP-CLI
wp plugin deactivate wedevs-project-manager-business

# Example: disable open user registration in WordPress
wp option update users_can_register 0