WP Project Manager Pro - Best Project Management Tool for WordPress v4.0.8 Nulled
= v4.0.8 – Aug 19, 2026 =
**Security:** Fixed a Subscriber-level SQL injection via the list "orderby" parameter in Sprint, Sub-task, Time Tracker and Label lists. Reported by Patchstack (dutafi).
**Security:** Gated every report REST route and removed report user-impersonation, closing unauthenticated report exfiltration.
**Security:** Enforced project membership and bound request IDs across Sprint, Invoice, Sub-task, Custom Field, Gantt, Search and Calendar endpoints (cross-project access / IDOR).
**Security:** Fixed a stored XSS in invoice client notes and a path traversal in invoice PDF export; stored data is now deserialized without instantiating objects.
**Improved:** Compatibility with WordPress 7.1 and PHP 8.4.
**Fixed:** Restored design-system styling when Pro is active (pm-pro.css now bundles the Free base CSS).