Taskbuilder subscribers can inject SQL through project filtering
Taskbuilder through 5.0.9 exposes the authenticated wppm_view_project_tasks AJAX action without a capability check beyond having a WordPress account. The request's wppm_proj_filter value can be re-read with only sanitize_text_field(), concatenated as an unquoted operand into Task.project, and embedded in the query instead of being passed as a $wpdb->prepare() argument. A Subscriber can therefore alter the query and extract sensitive database information. The CNA record does not identify the precise database contents obtainable. Version 6.0.0 casts the value with absint() and binds it with a %d placeholder.
- Component
- Taskbuilder – Project Management & Task Management Tool With Kanban Board
- Plugin slug
taskbuilder- Affected
- <= 5.0.9
- Safe version
6.0.0- Published
- Jul 28, 2026
This CVE was published Jul 28, 2026 and is one of 16 known issues for this plugin.
Update, patch or deactivate.
Update Taskbuilder to 6.0.0 or later. Review authenticated admin-ajax.php requests using action=wppm_view_project_tasks and unusual wppm_proj_filter values, and investigate possible database disclosure.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL Injection via the 'wppm_proj_filter' parameter in versions up to, and including, 5.0.9. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query — the value is re-read at line 144 using only sanitize_text_field() (overwriting the earlier absint() result), then concatenated into the SQL WHERE clause as an unquoted numeric operand using only esc_sql(), which does not protect against injection in that context, and finally string-interpolated into the $wpdb->prepare() format string, bypassing parameterization entirely. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N