PT-2025-47042 · WordPress · Wp Project Manager

Michael Mazzolini · Published 2025-11-15 · Updated 2025-11-15 · CVE-2025-8994

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Project Manager plugin for WordPress versions prior to 2.6.27

Description The WP Project Manager plugin for WordPress is susceptible to a time-based SQL Injection issue. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries, specifically affecting the completed at operator parameter. Authenticated attackers with Subscriber-level access or higher can inject additional SQL queries into existing queries to extract sensitive information from the database.

Recommendations Update the WP Project Manager plugin to version 2.6.27 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-8994

Affected Products

Wp Project Manager

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-8994 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/74984cc6-06b1-4c3a-a3e6-9e104c71e9c5?source=cve · Note
• https://twitter.com/CVEnew/status/1989571696748367926 · Twitter Post
• https://t.me/CVEtracker/37410 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1989583743128887723 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/2.6.24/src/Task/Helper/Task.php#L1484 · Note
• https://t.me/cveNotify/142903 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3386164 · Note