Taskbuilder CVE-2026-52697

Exploitation requires an authenticated WordPress account at Subscriber level or above on a site with the Taskbuilder plugin installed and active at version 5.0.7 or earlier, and the targeted Taskbuilder endpoint must be reachable by that low-privileged role. The practical limiting factor is whether the WordPress site permits user self-registration (Settings > General > 'Anyone can register') or otherwise grants Subscriber accounts to untrusted users; sites with closed registration restrict the attack to insiders or to attackers who have already obtained valid credentials by other means. No user interaction by an administrator is needed (UI:N), and the attack works over the network against default plugin configurations once a Subscriber session exists.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L reflects remotely reachable, low-complexity exploitation by any authenticated Subscriber - a privilege tier that many WordPress sites grant automatically on open registration - with a scope change yielding high confidentiality impact on the database. No EPSS score, KEV listing, or public POC was provided, which tempers immediate urgency but does not reduce the structural risk: SQLi in WordPress plugins is routinely weaponized within weeks of Patchstack disclosure. The asymmetry between high CVSS (8.5) and absent exploitation telemetry suggests this is a real priority for any site running the plugin with open registration, even though widespread mass-exploitation is not yet observable.

An attacker registers a free Subscriber account on a WordPress site running Taskbuilder <= 5.0.7, then sends a crafted request to a vulnerable plugin endpoint with SQL payloads in a parameter that is concatenated into a backend query. The injection extracts administrator password hashes and session tokens from wp_users and wp_usermeta, which the attacker then cracks or replays to escalate to full site takeover. No public exploit identified at time of analysis, but Patchstack-published WordPress SQLi flaws are commonly reproduced quickly.