EUVD-2026-40898
GHSA-vm7h-7fwq-hq44
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable AJAX endpoint, subscriber auth sufficient (PR:L), read-only injection yields high confidentiality loss with no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Taskbuilder - Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to generic SQL Injection via the 'wppm_proj_filter' parameter in all versions up to, and including, 5.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. No nonce verification is performed on the wp_ajax_wppm_view_project_tasks handler, meaning any authenticated session - including subscriber-level - can reach the vulnerable code path without any additional preconditions.
AnalysisAI
SQL injection in the Taskbuilder Project Management plugin for WordPress (versions ≤5.0.8) enables any authenticated user-including those with only subscriber-level access-to exfiltrate sensitive data from the WordPress database. The vulnerability exists in the wppm_proj_filter parameter handled by wppm_view_project_tasks.php, which lacks both proper SQL escaping and prepared statement usage. Compounding the risk, the wp_ajax_wppm_view_project_tasks AJAX handler performs no nonce verification, meaning the vulnerable code path is reachable by any authenticated WordPress session without additional preconditions. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL injection. The affected code resides in includes/admin/projects/open_project/wppm_view_project_tasks.php (lines L21 and L181 per Trac references), where the wppm_proj_filter POST/GET parameter is concatenated or interpolated into an existing SQL query without adequate sanitization or parameterization via WordPress's $wpdb->prepare(). The AJAX action wppm_view_project_tasks is registered via WordPress's wp_ajax_ hook in includes/class-wppm-admin.php at line L506. Because no nonce verification is enforced on this handler, any valid WordPress authentication cookie-regardless of role-satisfies the only access control check. The CPE string cpe:2.3:a:taskbuilder:taskbuilder_-_project_management_&_task_management_tool_with_kanban_board:*:*:*:*:*:*:*:* confirms the scope is limited to the plugin itself, not the WordPress core.
RemediationAI
The primary fix is to upgrade the Taskbuilder plugin to version 5.0.9 or later. The patched changeset is available at https://plugins.trac.wordpress.org/changeset?old_path=%2Ftaskbuilder/tags/5.0.8&new_path=%2Ftaskbuilder/tags/5.0.9, and the specific file fix is visible at https://plugins.trac.wordpress.org/changeset/3576941/taskbuilder/trunk/includes/admin/projects/open_project/wppm_view_project_tasks.php. Note: the patch version 5.0.9 is inferred from the Trac changeset URL and has not been independently confirmed as a tagged WordPress.org release-verify availability in the plugin repository before deploying. If immediate patching is not possible, a targeted compensating control is to block unauthenticated and subscriber-role access to admin-ajax.php?action=wppm_view_project_tasks at the WAF or reverse-proxy layer; however, this may break legitimate plugin functionality for non-admin users. Alternatively, disabling open user registration reduces the pool of potential attackers to already-trusted accounts. Sites that cannot patch should also consider enabling a WAF rule to detect SQL injection patterns in the wppm_proj_filter parameter.
More in Taskbuilder
View allReflected cross-site scripting in the Taskbuilder WordPress plugin before 5.0.8 lets an unauthenticated attacker inject
The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any a
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Team T
SQL injection in the Taskbuilder WordPress plugin versions 5.0.7 and earlier allows authenticated Subscriber-level users
The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'load_orders' parameter and uses it
SQL Injection in the Taskbuilder Project Management & Task Management WordPress plugin (versions up to and including 5.0
Time-based blind SQL injection in the Taskbuilder - Project Management & Task Management Tool With Kanban Board WordPres
The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statemen
The Taskbuilder - WordPress Project & Task Management plugin plugin for WordPress is vulnerable to Stored Cross-Site Scr
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today