CVE-2026-12110: Taskbuilder WordPress Plugin SQLi Flaw

CVE-2026-12110 Overview

CVE-2026-12110 is a SQL Injection vulnerability [CWE-89] in the Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress. The flaw affects all versions up to and including 5.0.8. Authenticated attackers with subscriber-level access can inject arbitrary SQL through the task_search parameter handled by the wppm_get_task_list AJAX endpoint. The endpoint lacks both capability checks and nonce verification, exposing it to any logged-in user. Successful exploitation enables extraction of sensitive database contents, including credentials and user data stored in the WordPress database.

Critical Impact
Any authenticated WordPress user, including subscribers, can execute arbitrary SQL queries and exfiltrate database contents through the vulnerable AJAX handler.

Affected Products

Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress
All versions up to and including 5.0.8
Fixed in version 5.0.9

Discovery Timeline

2026-07-01 - CVE-2026-12110 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-12110

Vulnerability Analysis

The vulnerability resides in the Taskbuilder plugin's task listing logic. The wppm_get_task_list AJAX handler processes the user-supplied task_search parameter and concatenates it into a SQL query without adequate escaping or use of prepared statements. This design allows an attacker to append additional SQL clauses to the existing query. The result is a generic SQL Injection primitive that supports UNION-based or boolean-based extraction of arbitrary data from the WordPress database, including wp_users password hashes and secret keys stored in options tables.

Root Cause

Two issues combine to produce the vulnerability. First, the query builder in wppm_tasks_list.php fails to properly sanitize or parameterize the task_search input before passing it to the database layer. Second, the AJAX handler registered in class-wppm-admin.php performs neither a current_user_can() capability check nor a check_ajax_referer() nonce validation. This absence of authorization controls lowers the required privilege to any authenticated user account.

Attack Vector

An attacker first obtains any authenticated session, including a Subscriber account created through open registration on many WordPress sites. The attacker then sends a crafted POST request to /wp-admin/admin-ajax.php with action=wppm_get_task_list and a malicious task_search value containing SQL syntax. Because the endpoint is reachable over the network and requires only low privileges, exploitation does not require user interaction. The attacker receives injected query results through the AJAX response, enabling incremental database exfiltration.

No verified public proof-of-concept code is available. See the Wordfence Vulnerability Analysis and the WordPress Changeset 3576941 for the patched code diff.

Detection Methods for CVE-2026-12110

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=wppm_get_task_list combined with SQL metacharacters such as UNION, SELECT, --, ', or 0x in the task_search parameter.
Anomalous database query volume or long-running queries originating from the WordPress database user.
Unexpected access to the wp_users, wp_usermeta, or wp_options tables during requests to the Taskbuilder AJAX action.
Newly created low-privilege subscriber accounts followed by AJAX requests to wppm_get_task_list.

Detection Strategies

Inspect web server access logs for requests to admin-ajax.php with the wppm_get_task_list action and flag any request whose task_search value contains SQL keywords or encoded payloads.
Enable MySQL general query logging or a database activity monitor to correlate WordPress AJAX requests with suspicious SELECT patterns targeting authentication tables.
Deploy a Web Application Firewall (WAF) rule that blocks SQL syntax in the task_search parameter of the affected action.

Monitoring Recommendations

Alert on repeated 200-response AJAX calls to wppm_get_task_list from a single authenticated session within a short time window, indicating iterative data extraction.
Monitor WordPress user role changes and new registrations, particularly on sites where subscriber self-registration is enabled.
Track outbound network volume from the WordPress host to detect bulk exfiltration following successful injection.

How to Mitigate CVE-2026-12110

Immediate Actions Required

Update the Taskbuilder plugin to version 5.0.9 or later on all WordPress sites where it is installed.
Disable open user registration or restrict the default role until patching is complete to reduce the pool of attackers with subscriber-level access.
Audit the wp_users table for unfamiliar accounts and force password resets for privileged users if compromise is suspected.
Rotate WordPress secret keys, database credentials, and any API tokens stored in the wp_options table after patching.

Patch Information

The vendor addressed the flaw in Taskbuilder version 5.0.9. Review the fix in WordPress Changeset 3576941 and the full version diff between 5.0.8 and 5.0.9. The patch introduces proper sanitization of the task_search parameter in wppm_tasks_list.php.

Workarounds

Deactivate and remove the Taskbuilder plugin until the site can be updated to version 5.0.9.
Add a WAF rule that rejects requests to admin-ajax.php where action=wppm_get_task_list and the task_search parameter contains SQL syntax such as UNION, SELECT, or quote characters.
Restrict access to /wp-admin/admin-ajax.php at the network layer for untrusted clients where feasible.

bash

# Example ModSecurity rule blocking SQL syntax in task_search
SecRule ARGS:action "@streq wppm_get_task_list" \
    "id:1026121100,phase:2,chain,deny,status:403,\
    msg:'CVE-2026-12110 Taskbuilder SQLi attempt'"
    SecRule ARGS:task_search "@rx (?i)(union|select|--|';|/\*)"