CVE-2026-2351: Task Manager WordPress Information Disclosure

CVE-2026-2351 Overview

The Task Manager plugin for WordPress contains an Arbitrary File Read vulnerability in all versions up to, and including, 3.0.2. The vulnerability exists in the callback_get_text_from_url() function, which allows authenticated attackers with Subscriber-level access or higher to read the contents of arbitrary files on the server. This can expose sensitive information including configuration files, database credentials, and other critical data stored on the web server.

Critical Impact
Authenticated attackers with minimal privileges (Subscriber-level) can read arbitrary files on the server, potentially exposing sensitive configuration data, credentials, and other confidential information.

Affected Products

Task Manager plugin for WordPress versions up to and including 3.0.2
WordPress installations using vulnerable Task Manager plugin versions
Any server hosting affected WordPress sites with the vulnerable plugin

Discovery Timeline

2026-03-21 - CVE-2026-2351 published to NVD
2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-2351

Vulnerability Analysis

This vulnerability is classified as CWE-73 (External Control of File Name or Path), a category of weaknesses where external input influences file system operations without proper validation. The vulnerable callback_get_text_from_url() function in the Task Manager plugin fails to adequately restrict which files can be accessed, enabling attackers to traverse the file system and read arbitrary files.

The attack requires only low-privilege authentication (Subscriber-level), making it relatively easy to exploit since WordPress allows user registration by default on many installations. Once authenticated, an attacker can leverage this vulnerability to access sensitive files such as wp-config.php, which contains database credentials, authentication keys, and other critical configuration parameters.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the callback_get_text_from_url() function located in the import module (class-import-action.php). The function accepts external input to specify file paths or URLs without implementing proper restrictions on accessible resources. This allows attackers to supply arbitrary file paths, bypassing intended access controls and reading files outside the expected directory scope.

Attack Vector

The vulnerability is exploited over the network and requires authentication with at least Subscriber-level privileges. An attacker would:

Register or obtain a Subscriber-level account on the target WordPress site
Send a crafted request to the callback_get_text_from_url() function
Supply a file path pointing to sensitive server files (e.g., ../../../wp-config.php)
Receive the contents of the targeted file in the response

The vulnerability is located in the import action handler at line 203 of class-import-action.php. The function processes user-controlled input without adequate path validation, allowing directory traversal sequences to access files outside the intended scope. Technical details can be found in the WordPress Plugin Code Reference.

Detection Methods for CVE-2026-2351

Indicators of Compromise

Unusual HTTP requests targeting the Task Manager plugin's import functionality with path traversal patterns
Server access logs showing requests containing ../ sequences or absolute file paths to system files
Requests from subscriber-level users attempting to access callback_get_text_from_url endpoints
Evidence of unauthorized access to sensitive configuration files like wp-config.php

Detection Strategies

Monitor web application firewall (WAF) logs for path traversal attempts targeting WordPress plugin endpoints
Implement file integrity monitoring on critical configuration files
Review WordPress user activity logs for suspicious subscriber-level actions
Deploy endpoint detection rules to identify file read operations on sensitive paths initiated through web requests

Monitoring Recommendations

Enable verbose logging for the Task Manager plugin and related WordPress import functions
Configure alerts for any access attempts to sensitive files via web requests
Monitor for outbound data exfiltration following potential file read exploitation
Implement SentinelOne Singularity to detect and alert on anomalous file access patterns from web server processes

How to Mitigate CVE-2026-2351

Immediate Actions Required

Update the Task Manager plugin to a patched version immediately (if available)
If no patch is available, disable or remove the Task Manager plugin until a fix is released
Review user accounts and remove unnecessary subscriber-level accounts
Audit server logs for evidence of exploitation attempts
Restrict file system permissions to limit web server access to sensitive files

Patch Information

WordPress site administrators should check the WordPress Plugin Overview page for updates to the Task Manager plugin. Monitor the Wordfence Vulnerability Report for additional mitigation guidance and patch availability announcements.

Workarounds

Disable the Task Manager plugin until a security patch is available
Implement Web Application Firewall (WAF) rules to block path traversal patterns targeting the vulnerable endpoint
Restrict WordPress user registration to prevent attackers from obtaining subscriber-level access
Use server-level file permission hardening to prevent the web server process from reading sensitive files outside the web root

bash

# Restrict access to wp-config.php at the Apache level
<Files wp-config.php>
    Order Allow,Deny
    Deny from all
</Files>

# Alternatively, for Nginx, add to server block:
# location ~* wp-config\.php {
#     deny all;
# }