CVE-2026-32478: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in weDevs Pte. Ltd WP Project Manager Pro

This vulnerability (CVE-2026-32478) is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in WP Project Manager Pro by weDevs Pte. Ltd. It affects all versions up to 4.0.1 inclusive. The issue allows an attacker with low privileges to inject SQL commands due to insufficient input sanitization in the Subscriber functionality. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

An attacker with low privileges can exploit this SQL Injection vulnerability to execute unauthorized SQL commands, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). The vulnerability does not impact data integrity. The scope of the impact extends beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable functionality and monitor for unusual database activity. Avoid exposing the affected component to untrusted users. Follow vendor communications for updates on patches or official mitigations.