CVE-2026-12090: Taskbuilder WordPress Plugin SQL Injection (6.5 MEDIUM)

Technical summary

The plugin's AJAX handler 'wp_ajax_wppm_view_project_tasks' processes the 'wppm_proj_filter' parameter without proper SQL escaping or prepared statements. An authenticated attacker can craft malicious SQL syntax within this parameter to append arbitrary queries to the existing database operation. The absence of nonce validation on the AJAX endpoint means the vulnerable code path is accessible to any authenticated session, regardless of privilege level. This is a classic SQL injection scenario (CWE-89) where user input flows directly into query construction without sanitization.

Business impact

If your organization uses Taskbuilder for internal project management, a compromised WordPress account—including low-privilege subscriber accounts—can be leveraged to retrieve sensitive project data, user information, credentials stored in the database, or other confidential records. This is especially concerning if the plugin shares a database with other WordPress installations or contains integration data with external systems. The threat is heightened in multi-tenant or agency environments where subscriber accounts are common.

Affected systems

Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress in version 5.0.8 and all prior versions. Any WordPress installation using this plugin with authenticated user accounts (subscriber level or higher) is at risk.

Exploitability

The vulnerability is straightforward to exploit for anyone with WordPress account credentials. No special tools, authentication bypass, or complex prerequisites are required beyond a valid login. The CVSS score of 6.5 (MEDIUM) reflects high confidentiality impact but limited scope—attackers can read data but not modify or delete it. The barrier to exploitation is low: basic SQL injection knowledge and the ability to send a crafted AJAX request with malicious SQL syntax.

Remediation

Update the Taskbuilder plugin to a patched version that implements proper parameterized queries and SQL escaping for the 'wppm_proj_filter' parameter. Verify the patch version against the vendor's official advisory. Additionally, review and tighten WordPress user role assignments to minimize the number of accounts with subscriber-level or higher access, reducing the attack surface.

Patch guidance

Check the WordPress plugin repository or the vendor's official security advisory for version 5.0.9 or later. Verify that the update specifically addresses SQL injection in the 'wppm_proj_filter' parameter. Before deploying to production, test the patch in a staging environment to ensure compatibility with your existing projects and any custom integrations. Plan the update during a maintenance window to avoid disrupting active users.

Detection guidance

Monitor AJAX requests to the wp_ajax_wppm_view_project_tasks endpoint for suspicious 'wppm_proj_filter' parameters containing SQL keywords (UNION, SELECT, WHERE clauses, comments, etc.). Database query logs may show unusual or nested SELECT statements originating from the plugin. Review WordPress user access logs to identify which subscriber accounts are accessing the plugin and when. Consider implementing a Web Application Firewall (WAF) rule to block requests with SQL injection patterns in this parameter.

Why prioritize this

This vulnerability merits prompt attention despite a MEDIUM CVSS score because: (1) exploitation requires only basic authentication, which is common in many organizations; (2) the impact is confidentiality breach of potentially sensitive project and user data; (3) there is no active exploitation in the wild (not on the KEV list), but the simplicity of the attack suggests rapid weaponization is likely once awareness spreads; (4) WordPress plugin vulnerabilities are frequently scanned by automated tools. Organizations should treat this as high priority for patching within 1–2 weeks.

Risk score, explained

The CVSS 3.1 score of 6.5 is derived from: Network accessibility (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), and no integrity or availability impact (I:N, A:N). The 'MEDIUM' severity reflects that while data confidentiality is fully compromised, the attacker cannot modify or destroy data, and the attack surface is limited to authenticated users. In context, however, the ease of exploitation and prevalence of subscriber accounts elevates practical risk.

Frequently asked questions