Taskbuilder CVE-2026-95599

Requires the Taskbuilder plugin at version 6.0.5 or earlier installed and active on a WordPress site, plus an authenticated account (PR:L in the CVSS vector indicates low-privilege authentication is required - not unauthenticated). The description does not name the specific vulnerable feature, endpoint, or parameter, stating only that versions from n/a through 6.0.5 are affected by blind SQL injection. Limiting factors: a valid login is mandatory, so sites that do not allow open/self-registration and restrict accounts substantially reduce exposure; exploitation is also gated on the vulnerable plugin being present. No special non-default configuration is indicated beyond having the plugin installed.

This is a credible-but-not-urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5 High) indicates a network-reachable, low-complexity blind SQL injection that requires only low-level authentication (PR:L) and no user interaction, with a changed scope and high confidentiality impact - consistent with the CWE-89 description. However, the strongest real-world exploitation signals are absent or weak: there is no CISA KEV listing, no public proof-of-concept referenced, and no EPSS value supplied in the input, so there is no evidence of active or automated exploitation at this time. The PR:L requirement is the key mitigating factor - an attacker needs a valid (even low-privileged) WordPress account, which meaningfully narrows the opportunistic attack surface compared to a fully unauthenticated flaw. Net: treat as a standard-priority patch for sites running the Taskbuilder plugin, elevated where untrusted users can self-register, but not an emergency absent exploitation evidence. Note the scope-change designation (S:C) is a Patchstack scoring convention for plugin-to-site-DB impact and is debatable; see assessed vector below.

An attacker who holds or registers a low-privileged WordPress account on a site running Taskbuilder ≤6.0.5 submits crafted input to a vulnerable plugin parameter, injecting SQL that the backend fails to neutralize. Because the injection is blind, the attacker infers data through boolean/time-based responses to progressively extract sensitive database contents such as user records and password hashes. No public exploit code was identified at time of analysis, so this would currently require custom exploit development.