Description

Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-24T22:17:19.947Z",
  "pubdate": "2026-08-24T22:17:19.947Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability has been identified in the WP Project Manager plugin, specifically affecting versions 4.0.6 and prior. This security flaw arises from the insecure handling of serialized data or user-supplied input passed into PHP unserialization routines within the application logic.\nThe primary impact of this vulnerability is the potential for remote code execution, unauthorized data access, file deletion, or server-side request forgery, depending on the presence of viable gadget chains within the application scope or the broader WordPress environment. The affected systems include any WordPress installation running vulnerable iterations of the WP Project Manager product.\nThe risk implications are severe, as unauthenticated malicious actors across the network can leverage this weakness without possessing any pre-existing privileges or user credentials. Exploitation requirements are limited to network reachability to the target WordPress instance and the existence of exploitable magic methods within available classes that facilitate object injection gadget chains.",
  "technicalDetails": "The root cause of the vulnerability stems from the insecure processing of input data using PHP's unserialized functions without proper sanitization or validation constraints. When untrusted input is passed directly to the unserialize() function, an attacker can manipulate the serialized string to instantiate arbitrary PHP classes currently loaded into the application memory.\nThe vulnerable component resides within the codebase of WP Project Manager <= 4.0.6, where input parameters received via HTTP requests are improperly handled and eventually subjected to object reconstruction. Because the vulnerability is unauthenticated, no session tokens, cookies, or user credentials are required to interact with the vulnerable endpoint over the network.\nThe attack flow proceeds in several distinct steps. First, the unauthenticated attacker crafts a malicious serialized payload containing specific property values designed to target magic methods such as __wakeup(), __destruct(), or __toString() within existing classes, commonly referred to as gadgets. Second, the attacker transmits this specially crafted payload via an HTTP request to the vulnerable endpoint exposed by WP Project Manager.\nThird, the application receives the payload and passes it into the vulnerable unserialization routine. As PHP reconstructs the serialized objects, the defined magic methods are automatically invoked based on the object lifecycle or state manipulation. Fourth, the execution of these magic methods triggers the attacker's constructed gadget chain, leading to secondary security consequences.\nPost-exploitation impact heavily relies on the classes available in the target environment. If a robust gadget chain is accessible, the attacker can achieve arbitrary code execution under the permissions of the web server user, compromise sensitive database contents, or execute system-level commands, thereby fully compromising the underlying host system."
}