CVE-2026-4004: WordPress Task Manager RCE Vulnerability

CVE-2026-4004 Overview

The Task Manager plugin for WordPress contains an arbitrary shortcode execution vulnerability in all versions up to and including 3.0.2. This vulnerability exists within the callback_search() function, which is accessible via the 'search' AJAX action. Due to missing capability checks and insufficient input validation, authenticated attackers with Subscriber-level access or above can execute arbitrary shortcodes on the affected WordPress site.

Critical Impact

Authenticated attackers can exploit this code injection vulnerability to execute arbitrary shortcodes, potentially leading to information disclosure, site manipulation, or privilege escalation depending on other installed plugins and their shortcode implementations.

Affected Products

• Task Manager plugin for WordPress versions up to and including 3.0.2
• WordPress sites with authenticated Subscriber-level users or higher
• Sites utilizing additional plugins that register sensitive shortcodes

Discovery Timeline

• 2026-03-21 - CVE CVE-2026-4004 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-4004

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection). The root cause lies in the callback_search() function within the navigation action module of the Task Manager plugin. The function fails to implement proper capability checks before processing user input, allowing any authenticated user (including those with minimal Subscriber privileges) to trigger the vulnerable code path.

The vulnerability is exploitable over the network without requiring user interaction. An attacker needs only low-level authentication to exploit this flaw, making it accessible to any registered user on a WordPress site running the vulnerable plugin. The impact includes potential confidentiality and integrity breaches, as arbitrary shortcode execution can expose sensitive data or modify site content depending on what shortcodes are registered by other plugins.

Root Cause

The vulnerability stems from two compounding security failures in the callback_search() function:

1. Missing Capability Checks: The AJAX callback does not verify that the requesting user has appropriate permissions to perform search operations. WordPress plugins should implement current_user_can() checks to restrict functionality to authorized users.

2. Insufficient Input Sanitization: While the plugin uses sanitize_text_field() to process user input, this function does not strip or escape shortcode syntax (square brackets). The sanitized input is then concatenated directly into a do_shortcode() call, allowing attackers to inject and execute arbitrary shortcodes.

Attack Vector

The attack can be performed by any authenticated user sending a crafted AJAX request to the WordPress site. The vulnerable parameters include task_id, point_id, categories_id, and term. By injecting shortcode syntax (e.g., [shortcode_name]) into any of these parameters, an attacker can cause the server to execute arbitrary registered shortcodes.

The vulnerability mechanism involves the WordPress AJAX handler routing requests to the callback_search() function in the navigation module. When user-controlled input containing shortcode syntax passes through sanitize_text_field(), the square brackets are preserved. This sanitized-but-still-malicious input is then processed by do_shortcode(), which interprets and executes the injected shortcode. For detailed technical analysis, see the Wordfence Vulnerability Report and the vulnerable source code.

Detection Methods for CVE-2026-4004

Indicators of Compromise

• Unexpected AJAX requests to WordPress admin-ajax.php with action parameter set to 'search' or navigation-related actions
• Log entries showing authenticated users accessing Task Manager search functionality with unusual parameter values containing square brackets
• Evidence of shortcode execution in server logs or database activity that does not correlate with legitimate administrative actions

Detection Strategies

• Monitor WordPress AJAX endpoints for requests containing shortcode syntax (square brackets) in POST or GET parameters
• Implement Web Application Firewall (WAF) rules to detect and block requests with [ and ] characters in Task Manager-related AJAX parameters
• Review authentication logs for Subscriber-level accounts making unusual numbers of AJAX requests
• Audit installed shortcodes to identify which could be abused if executed by unauthorized users

Monitoring Recommendations

• Enable detailed WordPress debug logging to capture AJAX request parameters and responses
• Configure SIEM rules to alert on patterns matching shortcode injection attempts in HTTP request data
• Implement file integrity monitoring for WordPress core files and plugin directories to detect any modifications resulting from successful exploitation

How to Mitigate CVE-2026-4004

Immediate Actions Required

• Update the Task Manager plugin to a patched version if available from the WordPress plugin repository
• If no patch is available, consider temporarily deactivating the Task Manager plugin until a fix is released
• Review user accounts and consider temporarily restricting or removing Subscriber-level accounts that are not essential
• Implement WAF rules to block AJAX requests containing shortcode syntax in vulnerable parameters

Patch Information

Review the WordPress Task Manager plugin repository for updated versions that address this vulnerability. The fix should include proper capability checks using current_user_can() and additional input validation to strip or escape shortcode syntax before processing. Monitor the Wordfence vulnerability report for updates on patch availability.

Workarounds

• Deactivate the Task Manager plugin if it is not critical to site operations
• Implement server-level input filtering to block requests containing shortcode patterns to the affected AJAX endpoints
• Restrict user registration and limit Subscriber-level account creation until a patch is applied
• Add custom capability checks via a security plugin or functions.php to restrict access to the vulnerable AJAX action

# Apache .htaccess rule to block suspicious AJAX requests
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} admin-ajax\.php$
RewriteCond %{QUERY_STRING} action=.*search.* [NC]
RewriteCond %{QUERY_STRING} (\[|\]) [NC]
RewriteRule .* - [F,L]
</IfModule>