EUVD-2026-40894
GHSA-9gpp-96v9-98wp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable AJAX endpoint (AV:N), trivially exploitable (AC:L), requires only Subscriber authentication (PR:L), yields full database read (C:H) with no write or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Taskbuilder - Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to generic SQL Injection via the 'task_search' parameter in all versions up to, and including, 5.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The wppm_get_task_list AJAX handler performs no capability check and no nonce verification, meaning any authenticated user including those with Subscriber-level access can invoke it directly.
AnalysisAI
SQL Injection in the Taskbuilder Project Management & Task Management WordPress plugin (versions up to and including 5.0.8) allows any authenticated WordPress user with Subscriber-level access or higher to exfiltrate arbitrary data from the site's database. The root cause is dual: insufficient escaping of the 'task_search' parameter in the wppm_get_task_list AJAX handler combined with a complete absence of capability checks and nonce verification on that handler, meaning the attack surface is broader than typical subscriber-exploitable SQLi. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; however, the low privilege bar and straightforward injection vector make this a credible threat against any WordPress site running the affected plugin.
Technical ContextAI
The vulnerability resides in the wppm_get_task_list WordPress AJAX action, implemented in includes/admin/tasks/wppm_tasks_list.php (confirmed at line 215 via plugin Trac references) and registered in includes/class-wppm-admin.php (line 40 and 516). The handler accepts a 'task_search' POST parameter and interpolates it directly into an SQL query without adequate escaping or parameterization, a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) defect. Critically, the handler is registered without a capability check and without nonce verification - two WordPress security primitives that together would limit access - meaning any session-authenticated user (including the lowest-privilege Subscriber role) can invoke the wp_ajax_ hook directly. The affected CPE is cpe:2.3:a:taskbuilder:taskbuilder_-_project_management_&_task_management_tool_with_kanban_board:*:*:*:*:*:*:*:* covering all versions through 5.0.8. The fix was committed in changeset 3576941 to wppm_tasks_list.php and shipped as version 5.0.9, as evidenced by the Trac changeset diff between tags 5.0.8 and 5.0.9.
RemediationAI
Upgrade the Taskbuilder plugin to version 5.0.9 or later, which addresses the SQL injection by applying proper parameter preparation in wppm_tasks_list.php (changeset 3576941). The upgrade is the only confirmed fix; the patch modifies SQL query construction and should be applied immediately. If an immediate upgrade is not possible, the most effective compensating control is to disable open user registration in WordPress (Settings → General → uncheck 'Anyone can register'), raising the bar from any internet user to only those with pre-issued credentials. Additionally, a Web Application Firewall (WAF) rule blocking SQL metacharacters in the task_search POST parameter targeting wp-admin/admin-ajax.php with action=wppm_get_task_list can block exploitation attempts at the perimeter, though WAF bypass is possible with encoding variations. Neither compensating control patches the underlying flaw; upgrade to 5.0.9 remains the required remediation. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/78ab6263-7762-4fd2-af42-2224efa9509e provides additional context.
More in Taskbuilder
View allReflected cross-site scripting in the Taskbuilder WordPress plugin before 5.0.8 lets an unauthenticated attacker inject
The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any a
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Team T
SQL injection in the Taskbuilder WordPress plugin versions 5.0.7 and earlier allows authenticated Subscriber-level users
The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'load_orders' parameter and uses it
SQL injection in the Taskbuilder Project Management plugin for WordPress (versions ≤5.0.8) enables any authenticated use
Time-based blind SQL injection in the Taskbuilder - Project Management & Task Management Tool With Kanban Board WordPres
The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statemen
The Taskbuilder - WordPress Project & Task Management plugin plugin for WordPress is vulnerable to Stored Cross-Site Scr
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today