Release v4.0.8
Wp Project Manager Pro - Business v4.0.8
What's new in v4.0.8
Wp Project Manager Pro - Business v4.0.8 was released on . Overview Dashboard Get a bird’s eye view of all your company projects, its associated team members and other details. See the full changelog below and compare with the complete version history.
Release details
Released
7.9 MB
File available
Changelog
**Security:** Fixed a Subscriber-level SQL injection via the list "orderby" parameter in Sprint, Sub-task, Time Tracker and Label lists. Reported by Patchstack (dutafi).
**Security:** Gated every report REST route and removed report user-impersonation, closing unauthenticated report exfiltration.
**Security:** Enforced project membership and bound request IDs across Sprint, Invoice, Sub-task, Custom Field, Gantt, Search and Calendar endpoints (cross-project access / IDOR).
**Security:** Fixed a stored XSS in invoice client notes and a path traversal in invoice PDF export; stored data is now deserialized without instantiating objects.
**Improved:** Compatibility with WordPress 7.1 and PHP 8.4.
**Fixed:** Restored design-system styling when Pro is active (pm-pro.css now bundles the Free base CSS).
Compatibility
- Requires WordPress
- 6.2
- Tested up to
- 7.1
- Requires PHP
- 7.4
Verified safe
Wp Project Manager Pro - Business v4.0.8 scanned clean with no security threats detected.
View full scan report