EUVD-2026-36903
GHSA-whmx-827p-3wxv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Network-reachable WordPress endpoint, low complexity, requires a Subscriber account (PR:L); SQLi crosses scope into the shared DB yielding high confidentiality, no direct integrity, and low availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
1DescriptionCVE.org
Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.
AnalysisAI
SQL injection in the Taskbuilder WordPress plugin versions 5.0.7 and earlier allows authenticated Subscriber-level users to inject malicious SQL into backend database queries, enabling exposure of sensitive data including credential hashes and limited integrity/availability impact on the underlying WordPress site. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 8.5 driven by a scope change to the database tier; there is no public exploit identified at time of analysis and the issue is not on CISA KEV.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account at Subscriber level or above on a site with the Taskbuilder plugin installed and active at version 5.0.7 or earlier, and the targeted Taskbuilder endpoint must be reachable by that low-privileged role. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L reflects remotely reachable, low-complexity exploitation by any authenticated Subscriber - a privilege tier that many WordPress sites grant automatically on open registration - with a scope change yielding high confidentiality impact on the database. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free Subscriber account on a WordPress site running Taskbuilder <= 5.0.7, then sends a crafted request to a vulnerable plugin endpoint with SQL payloads in a parameter that is concatenated into a backend query. The injection extracts administrator password hashes and session tokens from wp_users and wp_usermeta, which the attacker then cracks or replays to escalate to full site takeover. … |
| Remediation | Patch available per vendor advisory; administrators should upgrade Taskbuilder to the version above 5.0.7 published on the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/taskbuilder/vulnerability/wordpress-taskbuilder-plugin-5-0-7-sql-injection-vulnerability and verify via the WordPress plugin updater. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress instances for Taskbuilder plugin installation and version. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Share
External POC / Exploit Code
Leaving vuln.today