Taskbuilder <= 5.0.9 Authenticated SQL Injection Vulnerability (CVE-2026-12110) Advisory

Vulnerability Overview Vulnerability Name: Taskbuilder <= 5.0.9 - Authenticated (Subscriber+) SQL Injection CVE ID: CVE-2026-12110 CVSS Score: 6.5 (Medium) Release Date: July 27, 2026 Last Updated: July 28, 2026 Researchers: N0n Nss Affected Software Software Type: Plugin Software Name: Taskbuilder – Project Management & Task Management Tool With Kanban Board Affected Versions: <= 5.0.9 Fixed Version: 6.0.0 Remediation Fix Method: Update to version 6.0.0 or later patched versions Vulnerability Description The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin versions 5.0.9 and earlier contain a SQL injection vulnerability. This vulnerability arises from insufficient escaping of user-supplied parameter . The value is re-read within an existing SQL query (overriding the previous result with ), then concatenated into the SQL WHERE clause as an unquoted numeric operand using , which fails to prevent injection. In this scenario, the final string is inserted into the format string, completely bypassing parameterization. This allows authenticated attackers with subscriber-level access and above to append additional SQL queries to existing ones, enabling the extraction of sensitive information from the database. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information Wordfence Intelligence: Offers free personal and commercial API access to a comprehensive WordPress vulnerability database. Wordfence Intelligence WordPress Vulnerability Database: Provides completely free access and querying via API. Please refer to the documentation for details on accessing and using the vulnerability data API. Related Vulnerabilities Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter - CVE ID: CVE-2026-12110 - CVSS Score: 6.5 - Researcher: d4n_s3c - Date: June 30, 2026 Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'wpmm_prog_filter' Parameter - CVE ID: CVE-2026-12090 - CVSS Score: 6.5 - Researcher: Catalin Oancea (bx405A) - Date: June 30, 2026 Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.7 - Authenticated (Subscriber+) SQL Injection - CVE ID: CVE-2026-52697 - CVSS Score: 6.5 - Researcher: VanTastic - Date: June 10, 2026 Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.6 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' Parameter - CVE ID: CVE-2026-6225 - CVSS Score: 6.5 - Researcher: Louis Deschanel (JeanJeanLeHaxor) - Date: May 13, 2026 Taskbuilder <= 5.0.3 - Authenticated (Administrator) Stored Cross-Site Scripting via 'Block Emails' Field - CVE ID: CVE-2026-2289 - CVSS Score: 4.4 - Researcher: Phap Nguyen Anh - Date: March 3, 2026 Taskbuilder <= 5.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Project/Task Comment Creation - CVE ID: CVE-2026-1640 - CVSS Score: 4.3 - Researcher: Tarcisio Luches De Almeida Silva (Poystick) - Date: February 17, 2026 Taskbuilder <= 5.0.2 - Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters - CVE ID: CVE-2026-1639 - CVSS Score: 6.5 - Researcher: Tarcisio Luches De Almeida Silva (Poystick) - Date: February 17, 2026 Taskbuilder <= 4.0.9 - Reflected Cross-Site Scripting - CVE ID: CVE-2025-67933 - CVSS Score: 6.1 - Researcher: Skalucy - Date: January 6, 2026 Taskbuilder <= 4.0.7 - Missing Authorization - CVE ID: CVE-2025-30945 - CVSS Score: 5.3 - Researcher: Hiro - Date: June 5, 2025 Taskbuilder <= 4.0.1 - Authenticated (Subscriber+) SQL Injection - CVE ID: CVE-2025-39569 - CVSS Score: 6.5 - Researcher: astha raveri - Date: April 17, 2025 Summary The Taskbuilder plugin contains SQL injection vulnerabilities in multiple versions. Users are advised to update to the latest version as soon as possible to address these security issues.

Goal Reached Thanks to every supporter — we hit 100%!

Taskbuilder <= 5.0.9 Authenticated SQL Injection Vulnerability (CVE-2026-12110) Advisory

More from this source