What is the CVSS score of CVE-2026-4004?

CVE-2026-4004 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4004?

Organizations using all should be aware of notable risk from CVE-2026-4004, a code injection vulnerability rated CVSS 6.5.

How to fix or mitigate CVE-2026-4004?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

WordPress CVE-2026-4004

EUVD-2026-14150 MEDIUM

Code Injection (CWE-94)

2026-03-21 Wordfence

GHSA-2rj3-m9rf-r3xp

Code Injection WordPress RCE

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14150

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 6.5

DescriptionCVE.org

The Task Manager plugin for WordPress is vulnerable to arbitrary shortcode execution via the 'search' AJAX action in all versions up to, and including, 3.0.2. This is due to missing capability checks in the callback_search() function and insufficient input validation that allows shortcode syntax (square brackets) to pass through sanitize_text_field() and be concatenated into a do_shortcode() call. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes on the site by injecting shortcode syntax into parameters like 'task_id', 'point_id', 'categories_id', or 'term'.

AnalysisAI

The Task Manager plugin for WordPress (all versions up to 3.0.2) contains an arbitrary shortcode execution vulnerability in the AJAX search callback function due to missing capability checks and insufficient input validation. Authenticated attackers with Subscriber-level privileges and above can inject malicious shortcode syntax into search parameters to execute arbitrary shortcodes on the WordPress site, potentially leading to code execution and site compromise. The vulnerability is classified with a CVSS 3.1 score of 6.5 and has been reported by Wordfence security researchers.

Technical ContextAI

This vulnerability exploits a classic code injection weakness (CWE-94: Improper Control of Generation of Code) in the Task Manager plugin's callback_search() AJAX action handler. The root cause is that the function uses sanitize_text_field() to process user input from parameters such as task_id, point_id, categories_id, and term, but sanitize_text_field() does not strip or escape square bracket characters used in WordPress shortcode syntax. The sanitized user input is then directly concatenated into a do_shortcode() call, allowing attackers to inject valid shortcode syntax. WordPress shortcodes are a templating mechanism that execute PHP functions when processed, making this a direct path to code execution. The affected product is identified via CPE cpe:2.3:a:eoxia:task_manager with versions from inception through 3.0.2 confirmed vulnerable through source code review at the WordPress plugin repository (plugins.trac.wordpress.org).

RemediationAI

WordPress site administrators using the Task Manager plugin should immediately upgrade to a patched version when the Eoxia development team releases a fix beyond version 3.0.2. Until an official patch is available, disable the plugin entirely or restrict access to trusted administrative users only via WordPress user role management and capability filtering. Additionally, implement network-level protections such as Web Application Firewall (WAF) rules to block AJAX requests to the search action containing square bracket characters in parameter values, and enforce strict Content Security Policy (CSP) headers to limit the scope of shortcode-based code execution. Monitor WordPress security channels and the official Task Manager plugin repository for security advisories. For sites that cannot immediately patch, consider implementing application-level input validation at the AJAX handler entry point to reject requests containing shortcode delimiters before the vulnerable function processes them.