EUVD-2026-36903
GHSA-whmx-827p-3wxv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Network-reachable WordPress endpoint, low complexity, requires a Subscriber account (PR:L); SQLi crosses scope into the shared DB yielding high confidentiality, no direct integrity, and low availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
1DescriptionCVE.org
Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.
AnalysisAI
SQL injection in the Taskbuilder WordPress plugin versions 5.0.7 and earlier allows authenticated Subscriber-level users to inject malicious SQL into backend database queries, enabling exposure of sensitive data including credential hashes and limited integrity/availability impact on the underlying WordPress site. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 8.5 driven by a scope change to the database tier; there is no public exploit identified at time of analysis and the issue is not on CISA KEV.
Technical ContextAI
Taskbuilder is a WordPress plugin (CPE cpe:2.3:a:taskbuilder:taskbuilder:*) that exposes task-management endpoints to authenticated users. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates that user-controlled parameters reach a SQL query without proper parameterization or use of $wpdb->prepare(), letting an attacker break out of the intended query context. Because WordPress shares a single database across all plugins and core tables (wp_users, wp_usermeta, etc.), a successful SQLi from a low-privilege account can pivot far beyond the plugin's own data.
RemediationAI
Patch available per vendor advisory; administrators should upgrade Taskbuilder to the version above 5.0.7 published on the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/taskbuilder/vulnerability/wordpress-taskbuilder-plugin-5-0-7-sql-injection-vulnerability and verify via the WordPress plugin updater. Where immediate patching is not possible, disable open user registration in WordPress Settings > General (trading off self-service signup), deactivate the Taskbuilder plugin until updated (trading off the task-management feature), or place a WAF rule in front of the affected Taskbuilder AJAX/REST endpoints to block SQL meta-characters in request parameters (trading off potential false positives on legitimate task content). After patching, rotate any secrets and password hashes that may have been exposed via the shared wp_users table.
More in Taskbuilder
View allReflected cross-site scripting in the Taskbuilder WordPress plugin before 5.0.8 lets an unauthenticated attacker inject
The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any a
The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'load_orders' parameter and uses it
The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statemen
The Taskbuilder - WordPress Project & Task Management plugin plugin for WordPress is vulnerable to Stored Cross-Site Scr
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today