CVE-2026-32478 is an SQL Injection vulnerability (CWE-89) in WP Project Manager Pro by weDevs Pte. Ltd. It affects versions up to 4.0.1. The vulnerability arises from improper neutralization of special elements used in SQL commands within the Subscriber functionality. An attacker with low privileges can exploit this to execute arbitrary SQL commands, resulting in a high impact on confidentiality and a low impact on availability. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and scope change. No official patch or remediation level has been published yet.

Successful exploitation can lead to unauthorized disclosure of sensitive data due to SQL Injection. The confidentiality impact is high, integrity impact is none, and availability impact is low. The attacker requires low privileges and no user interaction, making exploitation feasible in certain scenarios. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable component and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the Subscriber functionality to untrusted users.