CVE-2026-6225: WordPress Taskbuilder Plugin SQLi Flaw

CVE-2026-6225 Overview

CVE-2026-6225 is a time-based blind SQL injection vulnerability in the Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress. The flaw affects all versions up to and including 5.0.6. The vulnerability resides in the project_search parameter, which the plugin fails to escape or properly parameterize before concatenating into SQL queries. Authenticated users with Subscriber-level access or higher can append SQL fragments to existing queries. Successful exploitation enables extraction of sensitive data from the WordPress database, including user credentials and session tokens.

Critical Impact

Authenticated attackers with low privileges can exfiltrate confidential database contents through time-based blind SQL injection in the project_search parameter.

Affected Products

• Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress
• All versions up to and including 5.0.6
• WordPress sites permitting Subscriber-or-above registration with the plugin installed

Discovery Timeline

• 2026-05-14 - CVE-2026-6225 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-6225

Vulnerability Analysis

The Taskbuilder plugin processes the project_search request parameter and incorporates the value directly into a SQL statement. The plugin does not apply wpdb::prepare() placeholders or sanitization helpers such as esc_sql() to that input. An authenticated attacker submits crafted payloads containing SQL conditionals combined with delay functions like SLEEP() or BENCHMARK(). The database response time reveals whether each conditional evaluated true, letting the attacker reconstruct query results bit by bit. Because the query executes with the privileges of the WordPress database user, attackers can read any table accessible to that account, including wp_users and wp_usermeta. This category of flaw maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Root Cause

The root cause is insufficient escaping of user-supplied input combined with absent prepared statements. The plugin concatenates the project_search value into a query string rather than binding it as a parameter. WordPress provides $wpdb->prepare() specifically to prevent this class of bug, but the affected code path bypasses it.

Attack Vector

The attack is delivered over the network via authenticated HTTP requests. The attacker only needs a Subscriber account, which many WordPress sites allow visitors to self-register. The attacker sends requests to the plugin endpoint that handles project searches, supplying a payload in the project_search parameter. No user interaction is required beyond the attacker's own session.

The vulnerability mechanism is documented in the WordPress Change Log Entry and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-6225

Indicators of Compromise

• HTTP requests containing SQL keywords such as SLEEP, BENCHMARK, UNION, or SELECT inside the project_search parameter
• Abnormally long response times for endpoints handled by the Taskbuilder plugin
• Authenticated Subscriber-level accounts issuing repeated, parameterized search requests in short windows
• Database slow-query log entries showing SLEEP() or conditional IF() calls originating from plugin queries

Detection Strategies

• Inspect WordPress access logs for requests to Taskbuilder AJAX or REST endpoints with suspicious values in project_search
• Enable the MySQL slow query log and alert on queries containing time-delay functions
• Deploy a web application firewall ruleset that flags SQL metacharacters in plugin parameters

Monitoring Recommendations

• Correlate spikes in 200-status responses with elevated server response latency on plugin endpoints
• Track new low-privilege account registrations followed by immediate plugin endpoint usage
• Forward WordPress and database logs to a centralized SIEM for query pattern analysis

How to Mitigate CVE-2026-6225

Immediate Actions Required

• Update the Taskbuilder plugin to the version released after 5.0.6 that includes the fix referenced in the WordPress plugin changeset 3507782
• Audit Subscriber and higher-privilege accounts for unauthorized registrations or recent activity
• Rotate WordPress administrator passwords and secret keys if exploitation is suspected

Patch Information

The vendor addressed the issue in the changeset published at plugins.trac.wordpress.org/changeset/3507782/taskbuilder. Site operators should upgrade to the latest plugin release through the WordPress admin Plugins screen or via WP-CLI.

Workarounds

• Disable the Taskbuilder plugin until the patched version is installed
• Restrict new user registration or set the default role to a custom role with no plugin access
• Place the WordPress site behind a web application firewall with SQL injection signatures enabled

# Configuration example: update the plugin using WP-CLI
wp plugin update taskbuilder --version=latest
wp plugin list --name=taskbuilder --fields=name,status,version