Threat database

CVE-2026-32478 is a high-severity SQL Injection vulnerability affecting WP Project Manager Pro versions up to and including 4.0.1. The flaw involves improper neutralization of special elements in SQL commands, specifically in the Subscriber component. This vulnerability could allow an attacker with low privileges to execute unauthorized SQL commands, potentially leading to data confidentiality breaches and limited availability impact. No official patch or remediation guidance is currently available from the vendor.