CVE-2026-12090: WordPress Taskbuilder SQLi Vulnerability

CVE-2026-12090 Overview

CVE-2026-12090 is a SQL Injection vulnerability [CWE-89] in the Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress. The flaw affects all versions up to and including 5.0.8. The vulnerability exists in the wppm_proj_filter parameter handled by the wp_ajax_wppm_view_project_tasks AJAX endpoint. Authenticated attackers with subscriber-level access can append arbitrary SQL to existing queries and extract sensitive database contents. The absence of nonce verification on the handler removes any additional preconditions for exploitation.

Critical Impact
Authenticated subscribers can extract sensitive data — including WordPress user credentials, session tokens, and application secrets — from the underlying database.

Affected Products

Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress
All versions up to and including 5.0.8
Fixed in version 5.0.9

Discovery Timeline

2026-07-01 - CVE-2026-12090 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-12090

Vulnerability Analysis

The Taskbuilder plugin exposes an AJAX action, wp_ajax_wppm_view_project_tasks, that is registered for any authenticated WordPress user. When the handler executes, it reads the wppm_proj_filter value directly from the request and concatenates it into a SQL statement inside includes/admin/projects/open_project/wppm_view_project_tasks.php. The plugin does not apply $wpdb->prepare() with proper placeholders, and it does not escape the input through esc_sql() or an equivalent sanitizer.

Because the AJAX handler is bound to the wp_ajax_ hook rather than a capability-gated endpoint, any logged-in user — including subscribers — can reach the vulnerable code path. The handler also omits a wp_verify_nonce() check, so cross-context requests and low-privilege sessions succeed without additional preconditions.

Root Cause

The root cause is insufficient input sanitization combined with unsafe query construction. User-controlled input reaches the database layer without parameter binding, allowing SQL syntax to be injected. This is a textbook CWE-89 instance in a WordPress AJAX handler.

Attack Vector

An authenticated attacker sends a crafted POST request to /wp-admin/admin-ajax.php with action=wppm_view_project_tasks and a malicious wppm_proj_filter value. The injected SQL fragment is appended to the existing query and executed with the database privileges of the WordPress site user. This enables data extraction through UNION-based, boolean-based, or time-based blind techniques.

See the Wordfence Vulnerability Report and the vulnerable source at line 181 for technical details on the injection point.

Detection Methods for CVE-2026-12090

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=wppm_view_project_tasks combined with SQL metacharacters such as UNION, SELECT, SLEEP(, or -- in the wppm_proj_filter parameter.
Unusually long response times on the wppm_view_project_tasks endpoint, indicating time-based blind SQL injection.
Requests to the vulnerable AJAX action originating from subscriber-level accounts that would not normally interact with project management workflows.

Detection Strategies

Inspect web server and WordPress access logs for the wppm_view_project_tasks action paired with encoded SQL payloads in POST bodies.
Deploy a web application firewall rule that flags SQL keywords in the wppm_proj_filter parameter.
Enable MySQL general query logging in test environments to correlate anomalous queries against the wp_users and wp_options tables with WordPress request identifiers.

Monitoring Recommendations

Alert on newly created or recently activated subscriber accounts issuing requests to admin-ajax.php actions outside typical low-privilege scope.
Monitor for outbound data patterns consistent with database dumping, such as sustained sequential requests with incrementing offsets.
Track plugin version inventory across WordPress deployments and flag any instance running Taskbuilder 5.0.8 or earlier.

How to Mitigate CVE-2026-12090

Immediate Actions Required

Update the Taskbuilder plugin to version 5.0.9 or later on all WordPress installations.
Audit existing WordPress user accounts and remove unused or unrecognized subscriber-level accounts.
Rotate WordPress administrator passwords, secret keys in wp-config.php, and any API tokens stored in the database if exploitation is suspected.

Patch Information

The vendor addressed the vulnerability in Taskbuilder 5.0.9. Review the official changeset 3576941 and the 5.0.8 to 5.0.9 diff for the specific code changes applied to the wppm_view_project_tasks handler.

Workarounds

Deactivate and remove the Taskbuilder plugin until upgrading to 5.0.9 is feasible.
Restrict registration on the affected WordPress site and disable open subscriber sign-up to reduce the attacker population.
Deploy a WAF rule that blocks requests to admin-ajax.php where action=wppm_view_project_tasks contains SQL syntax tokens in the wppm_proj_filter field.

bash

# Example ModSecurity rule blocking SQL tokens in the vulnerable parameter
SecRule ARGS_POST:action "@streq wppm_view_project_tasks" \
    "chain,phase:2,deny,status:403,id:1026120901,\
    msg:'CVE-2026-12090 Taskbuilder SQLi attempt'"
    SecRule ARGS_POST:wppm_proj_filter \
        "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|--|;)" \
        "t:none,t:urlDecodeUni"