Taskbot
Monthly
Arbitrary file upload in the WordPress plugin Taskbot (versions 6.6 and earlier) lets an authenticated attacker with only a subscriber-level account upload executable files to the server, which can be leveraged to run code and take full control of the hosting site. The vulnerability is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and stems from missing file type/extension validation in the plugin's upload handler (CWE-434); the scope-change metric reflects that compromising the plugin escalates into compromise of the whole WordPress installation. Exploitation requires a valid account at the subscriber role or higher - on sites that allow self-registration, that role is trivially obtainable by anyone, lowering the effective barrier close to unauthenticated. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so sites running Taskbot 6.6 or earlier should treat this as high priority.
Unauthenticated privilege escalation in the Amentotech Taskbot plugin for WordPress (versions 6.6 and earlier) allows any remote attacker to elevate privileges on a vulnerable site without credentials or victim interaction, as reflected by the CVSS 3.1 vector PR:N/UI:N/AC:L and a 9.8 base score. Because the flaw sits in privilege-assignment logic that is reachable in the plugin's default configuration, a standard installation that simply has Taskbot active is exposed; the practical limiting factor is that exposure depends entirely on this relatively uncommon plugin being deployed. There is confirmed actively exploited status absent - no CISA KEV entry was provided - and no public exploit code was identified in the supplied intelligence at time of analysis, so this should be prioritized on the basis of severity and ease of exploitation rather than observed attacks, with the caveat that corroborating intelligence is sparse and comes primarily from the Patchstack report.
Arbitrary file upload in the WordPress plugin Taskbot (versions 6.6 and earlier) lets an authenticated attacker with only a subscriber-level account upload executable files to the server, which can be leveraged to run code and take full control of the hosting site. The vulnerability is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and stems from missing file type/extension validation in the plugin's upload handler (CWE-434); the scope-change metric reflects that compromising the plugin escalates into compromise of the whole WordPress installation. Exploitation requires a valid account at the subscriber role or higher - on sites that allow self-registration, that role is trivially obtainable by anyone, lowering the effective barrier close to unauthenticated. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so sites running Taskbot 6.6 or earlier should treat this as high priority.
Unauthenticated privilege escalation in the Amentotech Taskbot plugin for WordPress (versions 6.6 and earlier) allows any remote attacker to elevate privileges on a vulnerable site without credentials or victim interaction, as reflected by the CVSS 3.1 vector PR:N/UI:N/AC:L and a 9.8 base score. Because the flaw sits in privilege-assignment logic that is reachable in the plugin's default configuration, a standard installation that simply has Taskbot active is exposed; the practical limiting factor is that exposure depends entirely on this relatively uncommon plugin being deployed. There is confirmed actively exploited status absent - no CISA KEV entry was provided - and no public exploit code was identified in the supplied intelligence at time of analysis, so this should be prioritized on the basis of severity and ease of exploitation rather than observed attacks, with the caveat that corroborating intelligence is sparse and comes primarily from the Patchstack report.