What is the CVSS score of EUVD-2026-36903?

EUVD-2026-36903 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Taskbuilder are affected by EUVD-2026-36903?

Taskbuilder WordPress plugin versions 5.0.7 and earlier contains a SQL injection vulnerability allowing authenticated Subscriber-level users to query the WordPress database directly, exposing…

How to fix or mitigate EUVD-2026-36903?

Within 24 hours: Audit all WordPress instances for Taskbuilder plugin installation and version. Within 7 days: Either disable Taskbuilder plugin entirely or eliminate Subscriber user accounts and restrict plugin access to Administrators only; enable database query logging. Within 30 days: Subscribe to Patchstack/Taskbuilder security channels for patch notification; deploy vendor patch to all affected instances immediately upon release.

Taskbuilder EUVD-2026-36903

| CVE-2026-52697 HIGH

SQL Injection (CWE-89)

2026-06-15 Patchstack

GHSA-whmx-827p-3wxv

SQLi Taskbuilder

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Network-reachable WordPress endpoint, low complexity, requires a Subscriber account (PR:L); SQLi crosses scope into the shared DB yielding high confidentiality, no direct integrity, and low availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:25 vuln.today

DescriptionCVE.org

Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.

AnalysisAI

SQL injection in the Taskbuilder WordPress plugin versions 5.0.7 and earlier allows authenticated Subscriber-level users to inject malicious SQL into backend database queries, enabling exposure of sensitive data including credential hashes and limited integrity/availability impact on the underlying WordPress site. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 8.5 driven by a scope change to the database tier; there is no public exploit identified at time of analysis and the issue is not on CISA KEV.

Technical ContextAI

Taskbuilder is a WordPress plugin (CPE cpe:2.3:a:taskbuilder:taskbuilder:*) that exposes task-management endpoints to authenticated users. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates that user-controlled parameters reach a SQL query without proper parameterization or use of $wpdb->prepare(), letting an attacker break out of the intended query context. Because WordPress shares a single database across all plugins and core tables (wp_users, wp_usermeta, etc.), a successful SQLi from a low-privilege account can pivot far beyond the plugin's own data.

RemediationAI

Patch available per vendor advisory; administrators should upgrade Taskbuilder to the version above 5.0.7 published on the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/taskbuilder/vulnerability/wordpress-taskbuilder-plugin-5-0-7-sql-injection-vulnerability and verify via the WordPress plugin updater. Where immediate patching is not possible, disable open user registration in WordPress Settings > General (trading off self-service signup), deactivate the Taskbuilder plugin until updated (trading off the task-management feature), or place a WAF rule in front of the affected Taskbuilder AJAX/REST endpoints to block SQL meta-characters in request parameters (trading off potential false positives on legitimate task content). After patching, rotate any secrets and password hashes that may have been exposed via the shared wp_users table.