Is CVE-2026-6225 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6225 being exploited in the wild.

How severe is CVE-2026-6225?

Medium severity, with a CVSS score of 6.5, published 14 May 2026.

Which products and versions are affected?

The Taskbuilder Taskbuilder Up to and including 5.0.6.

Is there a fix for CVE-2026-6225?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6225 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6225?

Check whether you run The Taskbuilder Taskbuilder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6225: The Taskbuilder WordPress plugin SQL injection in project_search

CVE-2026-6225 · Severity: medium · CVSS 6.5 · Published 2026-05-14

The Taskbuilder plugin for WordPress, used for project and task management, contains a security flaw that could allow logged-in users to access sensitive information from the website's database. By exploiting this vulnerability, an attacker with basic account access (such as a subscriber) could run unauthorized database queries. This could lead to the exposure of confidential business data, user credentials, or other private information stored on the site.

Technologies: The Taskbuilder Taskbuilder. Vendors: The Taskbuilder.

Quick answers

Is CVE-2026-6225 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6225 being exploited in the wild.
How severe is CVE-2026-6225?: Medium severity, with a CVSS score of 6.5, published 14 May 2026.
Which products and versions are affected?: The Taskbuilder Taskbuilder Up to and including 5.0.6.
Is there a fix for CVE-2026-6225?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6225 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6225?: Check whether you run The Taskbuilder Taskbuilder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Taskbuilder plugin for WordPress is vulnerable to time-based blind SQL injection due to insufficient escaping of the 'project_search' parameter and a lack of SQL query preparation. This vulnerability exists in all versions up to and including 5.0.6. An authenticated attacker with Subscriber-level permissions or higher can exploit this by sending crafted network requests to append malicious SQL commands to existing queries. Successful exploitation allows the attacker to exfiltrate sensitive data from the database based on the time delay of the server's response. A patch appears to be available in the plugin's changeset 3507782.

Affected products

The Taskbuilder Taskbuilder – Project Management & Task Management Tool With Kanban Board Up to and including 5.0.6

Timeline

2026-05-14: disclosed: Vulnerability published on NVD and Wordfence

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.