CVE-2026-15267 Overview
CVE-2026-15267 is a SQL Injection vulnerability [CWE-89] in the Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress. The flaw affects all versions up to and including 5.0.9. The wppm_proj_filter parameter is insufficiently sanitized before being concatenated into an SQL WHERE clause. Authenticated attackers with subscriber-level access or higher can append additional SQL queries to extract sensitive data from the WordPress database.
Critical Impact
Authenticated users with minimal privileges can execute arbitrary SQL statements against the WordPress database, leading to exposure of user credentials, session tokens, and other sensitive stored information.
Affected Products
- Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress
- All versions up to and including 5.0.9
- WordPress installations with subscriber-or-higher user registration enabled
Discovery Timeline
- 2026-07-28 - CVE-2026-15267 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-15267
Vulnerability Analysis
The vulnerability resides in includes/admin/projects/open_project/wppm_view_project_tasks.php. The wppm_proj_filter parameter is initially cast to an integer using absint(), which would normally neutralize injection. However, at line 144 the value is re-read and reassigned using only sanitize_text_field(), overwriting the safe integer result with an attacker-controlled string.
The reassigned value is then passed through esc_sql() and interpolated into the SQL WHERE clause as an unquoted numeric operand. esc_sql() escapes quotes but provides no protection when a value is used as an unquoted numeric operand. The tainted string is subsequently interpolated directly into the $wpdb->prepare() format string, bypassing parameterization.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. Three compounding coding errors enable exploitation: overwriting a safe absint() result with sanitize_text_field(), relying on esc_sql() for a numeric context where it offers no protection, and string-interpolating user input into the prepare() format string rather than using placeholders.
Attack Vector
An authenticated attacker holding at least a subscriber role sends a crafted request containing SQL syntax in the wppm_proj_filter parameter. Because the value is used as an unquoted numeric operand, standard UNION SELECT and boolean-based payloads succeed without quote escaping. The attacker can enumerate database schemas and read arbitrary table contents, including wp_users password hashes and wp_usermeta session data.
Refer to the vulnerable source at WordPress Task View PHP Code line 144 and the Wordfence Vulnerability Report for full technical details.
Detection Methods for CVE-2026-15267
Indicators of Compromise
- HTTP requests containing wppm_proj_filter with non-numeric characters, SQL keywords such as UNION, SELECT, SLEEP, or comment sequences like -- and /*
- Web server access logs showing repeated requests to Taskbuilder admin endpoints from subscriber-level accounts
- Unexpected database read errors or anomalously long query execution times in the WordPress database logs
- Outbound data transfer spikes from the web application host following authenticated plugin interactions
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule that inspects the wppm_proj_filter parameter and blocks non-integer values before they reach PHP
- Enable MySQL general query logging or slow-query logging and alert on queries referencing wp_users or information_schema originating from the Taskbuilder plugin
- Correlate authentication events with unusual admin-ajax or plugin endpoint access patterns from low-privilege accounts
Monitoring Recommendations
- Monitor WordPress user role assignments and flag any new subscriber accounts followed by activity against Taskbuilder endpoints
- Track outbound network traffic from web servers hosting the affected plugin for exfiltration signatures
- Audit database query telemetry for UNION-based patterns and time-based blind injection indicators such as SLEEP() or BENCHMARK()
How to Mitigate CVE-2026-15267
Immediate Actions Required
- Update the Taskbuilder plugin to the version released in WordPress Changeset 3576941 or later
- Audit existing WordPress user accounts and remove unnecessary subscriber-level access
- Rotate all WordPress user passwords and administrative session tokens if compromise is suspected
- Review database access logs for evidence of unauthorized SELECT activity against sensitive tables
Patch Information
The vendor addressed the vulnerability in WordPress Changeset 3576941. The fix replaces the unsafe string interpolation with a properly parameterized $wpdb->prepare() call and enforces integer casting on the wppm_proj_filter parameter. Administrators should upgrade to the patched release listed in the Wordfence Vulnerability Report.
Workarounds
- Disable the Taskbuilder plugin until patching is complete if the update cannot be applied immediately
- Restrict user registration and require administrator approval for new accounts to reduce the pool of authenticated attackers
- Deploy WAF signatures that block SQL metacharacters in the wppm_proj_filter request parameter
- Enforce least-privilege database credentials for WordPress so the plugin cannot read tables outside its required scope
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
