Junglewise Threat Intelligence

CVE-2026-12110: Taskbuilder WordPress Plugin SQL Injection in task_search

CVE-2026-12110 · Severity: medium · CVSS 6.5 · Published 2026-07-01

Executive brief

The Taskbuilder plugin for WordPress, used for project and task management, contains a security flaw that allows logged-in users to access sensitive database information. By exploiting a search feature, an attacker with even basic account access (like a subscriber) can bypass security controls to view data they are not authorized to see. This could lead to the exposure of confidential project details or user information.

Technical details

The Taskbuilder plugin for WordPress is vulnerable to a generic SQL injection due to insufficient escaping of the 'task_search' parameter and a lack of SQL query preparation in the wppm_get_task_list AJAX handler. The handler fails to implement capability checks or nonce verification, allowing any authenticated user, including those with Subscriber-level privileges, to trigger the vulnerable code path. Attackers can append malicious SQL queries to existing ones to exfiltrate sensitive data from the database. The issue is present in all versions up to and including 5.0.8 and was addressed in version 5.0.9.

Affected products

  • taskbuilder Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.8

Timeline

  • 2026-07-01: disclosed
  • 2026-07-01: advisory

References