A critical unauthenticated PHP object injection vulnerability in the weDevs WP Project Manager plugin enables potential remote code execution on affected systems.

The plugin fails to validate user input during deserialization processes. This allows an unauthenticated attacker to inject malicious PHP objects, which can be leveraged to execute arbitrary code.

The CVSS score of 9.8 reflects the extreme severity of this flaw, as it permits full system compromise without requiring any prior authentication. Successful exploitation would grant an attacker complete control over the WordPress environment, leading to total data loss, malware installation, or persistent backdoors.

Immediate Action: Update the WP Project Manager plugin to version 4.0.7 or the latest available version immediately.

Proactive Monitoring: Audit the server for unexpected file modifications or the creation of new, unrecognized files within the WordPress directory, which are common indicators of post-exploitation activity.

Compensating Controls: Utilize a Web Application Firewall (WAF) configured to inspect and block serialized PHP objects in incoming HTTP requests.

Public Exploit Available: Unknown.

Due to the critical nature of remote code execution vulnerabilities, immediate patching is required. Organizations should treat this as a high-priority security event and ensure that all instances of the WP Project Manager plugin are updated to the secure version.