EUVD-2026-93266
GHSA-65g5-v3cp-vq9q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or obtain subscriber account
-
DeliverySubmit crafted file upload request
-
ExploitBypass missing file-type validation
-
ExecutionWrite PHP web shell to webroot
-
PersistExecute shell for RCE
-
ImpactFull site and server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account at the subscriber role or higher (PR:L) on a site running the Taskbot plugin version 6.6 or earlier; the attacker then abuses the plugin's file upload functionality, which fails to validate file type/extension, to upload executable code. The practical limiting factor is the need for an account: on sites that disable open user registration this requires existing credentials, but on sites permitting self-registration (common for task/project-management plugins) the subscriber role is obtainable by anyone, effectively lowering the barrier to near-unauthenticated. No user interaction from an admin is needed (UI:N), and the attack works against the plugin's standard configuration. |
| Impact | This is a genuinely high-priority flaw where multiple signals align. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) describes a network-reachable, low-complexity attack requiring only low privileges (PR:L) and no user interaction, with a scope change and full confidentiality/integrity/availability impact - consistent with an arbitrary file upload (CWE-434) that lets a low-privileged user drop a web shell and achieve code execution. The 'subscriber' qualifier in the description matches PR:L: the attacker needs only the lowest WordPress account tier, which on sites with open registration is trivially obtained, making this close to an unauthenticated flaw in practice. Tempering the raw severity: no EPSS score was provided, the vulnerability is NOT on CISA KEV, and no public proof-of-concept is referenced, so there is no evidence of active exploitation - the risk is driven by exploit potential rather than observed attacks. The single source is Patchstack, a credible WordPress-specific intelligence vendor. Net: treat as a real, actionable priority for any site running Taskbot, but note the deployment footprint of this specific commercial plugin is limited, so this is a serious issue for affected sites rather than an internet-wide emergency. |
| Exploit ScenarioDerived | An attacker registers (or abuses an existing) subscriber-level account on a WordPress site running Taskbot <= 6.6, then abuses the plugin's unvalidated file upload handler to upload a malicious PHP file. Because no extension/MIME validation prevents it, they access the uploaded web shell directly and execute arbitrary code in the web server context, leading to full site compromise. No public exploit code is referenced, but the low attack complexity makes weaponization straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Arbitrary file upload in the WordPress plugin Taskbot (versions 6.6 and earlier) lets an authenticated attacker with only a subscriber-level account upload executable files to the server, which can be leveraged to run code and take full control of the hosting site. The vulnerability is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and stems from missing file type/extension validation in the plugin's upload handler (CWE-434); the scope-change metric reflects that compromising the plugin escalates into compromise of the whole WordPress installation. Exploitation requires a valid account at the subscriber role or higher - on sites that allow self-registration, that role is trivially obtainable by anyone, lowering the effective barrier close to unauthenticated. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so sites running Taskbot 6.6 or earlier should treat this as high priority.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so the primary action is to check the Taskbot plugin listing and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/taskbot/vulnerability/wordpress-taskbot-plugin-6-6-arbitrary-file-upload-vulnerability?_s_id=cve) for a corrected release and upgrade to it as soon as one exists; until then, the plugin should be considered vulnerable on any site running 6.6 or earlier. Because the exploit path requires a logged-in subscriber, the highest-value compensating control is to disable open user registration in WordPress settings (Settings > General > Membership) and remove or downgrade any untrusted accounts at subscriber level or above - the trade-off is that legitimate self-service onboarding of new users stops working. In parallel, harden the upload path: configure the web server to deny execution of PHP and other script extensions inside wp-content/uploads and any Taskbot-specific upload directory (for example an Apache <Directory> block with php_flag engine off or location rules in nginx that return 403 for .php files), understanding that this can break legitimate plugins that rely on direct execution in those paths. Add a WAF rule to block multipart uploads containing script content or unexpected extensions to Taskbot endpoints, accepting the usual risk of false positives on legitimate attachments, and monitor web logs and file-integrity tooling for newly written script files in upload directories. If Taskbot is not business-critical, deactivating and removing the plugin entirely eliminates the exposure; if it is critical, combine registration lockdown, upload-directory execution blocking, and active logging until the vendor patch is available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Taskbot is a WordPress plugin from vendor Amento Tech (CPE cpe:2.3:a:amentotech:taskbot:*:*:*:*:*:*:*:*) that provides task/project-management and marketplace workflow functionality, and it ships its own front-end file upload handling for task attachments and related submissions. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the plugin's upload routine does not adequately validate the file type or extension of submitted files, so a file such as a PHP script can be written into a web-accessible directory and then requested directly to execute. The CVSS vector reflects a network-reachable attack (AV:N) with low attack complexity (AC:L), no user interaction (UI:N), and low privileges required (PR:L) - meaning any account at the subscriber level, the lowest standard WordPress role, is sufficient. Because the uploaded file runs server-side under the web server's context, the plugin weakness crosses a security boundary: confidentiality, integrity, and availability impacts are all High and the scope is Changed (S:C), i.e., the compromise extends beyond the plugin to the underlying WordPress site and host. The plugin is distributed through the normal WordPress plugin ecosystem, and the finding was reported and catalogued by Patchstack.
Know when Taskbot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable upload needs only a subscriber account (PR:L) and no interaction; uploaded web shell yields code execution beyond the plugin's scope (S:C) with full C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.
Executive ViewAI
Taskbot versions 6.6 and earlier expose WordPress sites to full takeover by a low-privilege upload flaw, putting any organization using the plugin at risk of data theft, website defacement, and operational disruption. Because subscriber accounts are often easy to obtain, attackers may need only minimal access to compromise the entire site, making this a high-priority web presence and brand risk for leadership.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or uninstall Taskbot 6.6 and earlier; if continued use is unavoidable, disable self-registration, limit subscriber accounts, block executable file uploads via WAF or web server rules, disable PHP execution in WordPress upload directories, and monitor for suspicious file uploads or webshells.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Exploit-DB