CVE-2026-2351: Task Manager WordPress Information Disclosure

CVE-2026-2351 Overview

The Task Manager plugin for WordPress contains an Arbitrary File Read vulnerability in all versions up to, and including, 3.0.2. The vulnerability exists in the callback_get_text_from_url() function, which allows authenticated attackers with Subscriber-level access or higher to read the contents of arbitrary files on the server. This can expose sensitive information including configuration files, database credentials, and other critical data stored on the web server.

Critical Impact

Authenticated attackers with minimal privileges (Subscriber-level) can read arbitrary files on the server, potentially exposing sensitive configuration data, credentials, and other confidential information.

Affected Products

• Task Manager plugin for WordPress versions up to and including 3.0.2
• WordPress installations using vulnerable Task Manager plugin versions
• Any server hosting affected WordPress sites with the vulnerable plugin

Discovery Timeline

• 2026-03-21 - CVE-2026-2351 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-2351

Vulnerability Analysis

This vulnerability is classified as CWE-73 (External Control of File Name or Path), a category of weaknesses where external input influences file system operations without proper validation. The vulnerable callback_get_text_from_url() function in the Task Manager plugin fails to adequately restrict which files can be accessed, enabling attackers to traverse the file system and read arbitrary files.

The attack requires only low-privilege authentication (Subscriber-level), making it relatively easy to exploit since WordPress allows user registration by default on many installations. Once authenticated, an attacker can leverage this vulnerability to access sensitive files such as wp-config.php, which contains database credentials, authentication keys, and other critical configuration parameters.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the callback_get_text_from_url() function located in the import module (class-import-action.php). The function accepts external input to specify file paths or URLs without implementing proper restrictions on accessible resources. This allows attackers to supply arbitrary file paths, bypassing intended access controls and reading files outside the expected directory scope.

Attack Vector

The vulnerability is exploited over the network and requires authentication with at least Subscriber-level privileges. An attacker would:

1. Register or obtain a Subscriber-level account on the target WordPress site
2. Send a crafted request to the callback_get_text_from_url() function
3. Supply a file path pointing to sensitive server files (e.g., ../../../wp-config.php)
4. Receive the contents of the targeted file in the response

The vulnerability is located in the import action handler at line 203 of class-import-action.php. The function processes user-controlled input without adequate path validation, allowing directory traversal sequences to access files outside the intended scope. Technical details can be found in the WordPress Plugin Code Reference.

Detection Methods for CVE-2026-2351

Indicators of Compromise

• Unusual HTTP requests targeting the Task Manager plugin's import functionality with path traversal patterns
• Server access logs showing requests containing ../ sequences or absolute file paths to system files
• Requests from subscriber-level users attempting to access callback_get_text_from_url endpoints
• Evidence of unauthorized access to sensitive configuration files like wp-config.php

Detection Strategies

• Monitor web application firewall (WAF) logs for path traversal attempts targeting WordPress plugin endpoints
• Implement file integrity monitoring on critical configuration files
• Review WordPress user activity logs for suspicious subscriber-level actions
• Deploy endpoint detection rules to identify file read operations on sensitive paths initiated through web requests

Monitoring Recommendations

• Enable verbose logging for the Task Manager plugin and related WordPress import functions
• Configure alerts for any access attempts to sensitive files via web requests
• Monitor for outbound data exfiltration following potential file read exploitation
• Implement SentinelOne Singularity to detect and alert on anomalous file access patterns from web server processes

How to Mitigate CVE-2026-2351

Immediate Actions Required

• Update the Task Manager plugin to a patched version immediately (if available)
• If no patch is available, disable or remove the Task Manager plugin until a fix is released
• Review user accounts and remove unnecessary subscriber-level accounts
• Audit server logs for evidence of exploitation attempts
• Restrict file system permissions to limit web server access to sensitive files

Patch Information

WordPress site administrators should check the WordPress Plugin Overview page for updates to the Task Manager plugin. Monitor the Wordfence Vulnerability Report for additional mitigation guidance and patch availability announcements.

Workarounds

• Disable the Task Manager plugin until a security patch is available
• Implement Web Application Firewall (WAF) rules to block path traversal patterns targeting the vulnerable endpoint
• Restrict WordPress user registration to prevent attackers from obtaining subscriber-level access
• Use server-level file permission hardening to prevent the web server process from reading sensitive files outside the web root

# Restrict access to wp-config.php at the Apache level
<Files wp-config.php>
    Order Allow,Deny
    Deny from all
</Files>

# Alternatively, for Nginx, add to server block:
# location ~* wp-config\.php {
#     deny all;
# }