What is the CVSS score of CVE-2026-2351?

CVE-2026-2351 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2351?

Organizations using for WordPress is vulnerable to Arbitrary File Read in all should be aware of notable risk from CVE-2026-2351 rated CVSS 6.5.. A patch is available.

How to fix or mitigate CVE-2026-2351?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Arbitrary File Read in all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-2351

EUVD-2026-14165 MEDIUM

External Control of File Name or Path (CWE-73)

2026-03-21 Wordfence

GHSA-3754-c64r-8c26

GHSA-p8gp-2w28-mhwg

WordPress Information Disclosure

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14165

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 6.5

DescriptionCVE.org

The Task Manager plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.0.2 via the callback_get_text_from_url() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

AnalysisAI

The Task Manager plugin for WordPress contains an arbitrary file read vulnerability in the callback_get_text_from_url() function that allows authenticated attackers with Subscriber-level privileges and above to read sensitive files from the server. This information disclosure vulnerability affects all versions up to and including 3.0.2 of the eoxia Task Manager plugin. The vulnerability has a CVSS score of 6.5 and presents moderate real-world risk due to its low attack complexity and the prevalence of WordPress installations, though exploitation requires valid user credentials.

Technical ContextAI

The vulnerability exists in the callback_get_text_from_url() function within the Task Manager plugin's import action module (specifically in module/import/action/class-import-action.php at line 203 according to the plugin repository). The root cause is classified under CWE-73 (External Control of File Name or Path), which represents a path traversal or arbitrary file access weakness where user-supplied input is used to construct file paths without proper validation or sanitization. The affected product is identified via CPE as cpe:2.3:a:eoxia:task_manager, indicating this is an application-level vulnerability in a WordPress plugin rather than a core WordPress issue. The vulnerability allows unauthenticated-equivalent access through low-privileged user accounts, making it particularly dangerous in multi-user WordPress environments where subscriber accounts are commonly created.

RemediationAI

The primary remediation is to upgrade the Task Manager plugin to a patched version newer than 3.0.2 immediately through the WordPress dashboard (Plugins > Updates) or via https://wordpress.org/plugins/task-manager/. If an immediate patch is not available, disable the plugin entirely by navigating to Plugins > Installed Plugins and deactivating Task Manager until an update is released. As an interim mitigation, restrict user registration and audit existing subscriber accounts to remove unnecessary low-privileged accounts, reducing the attack surface. Additionally, implement security hardening through a web application firewall (WAF) configured to detect and block path traversal patterns in URL parameters, restrict file system permissions on the WordPress installation to least-privilege principles, and monitor access logs for suspicious patterns related to file inclusion attempts. Consult Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/cd959968-d3f0-4546-8fc6-eb451b417f0d for additional guidance and indicators of compromise.