Critical vulnerabilities
2 critical vulnerabilities in 2 WordPress plugins
2 vulnerabilities rated critical (CVSS 9.0 or higher) found on 31 October 2026: Authentication bypass in WordPress plugins, Remote code execution in WordPress plugins.
- 2 critical
Remote code execution in Project Manager · WordPress plugins
CVE-2026-116512
Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
- Severity
- Critical 9.8
- Published
- 31 Oct 2026
| Software | Affected versions |
|---|---|
| Wedevs Project Manager (WordPress plugin)WordPress plugins |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-116512
Authentication bypass in Uncanny Toolkit for LearnDash · WordPress plugins
CVE-2026-119096
Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter
- Severity
- Critical 9.8
- Published
- 31 Oct 2026
| Software | Affected versions |
|---|---|
| Uncanny Learndash Toolkit (WordPress plugin)WordPress plugins |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-119096
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.