[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fftjd7i4RMZtEZ0nY6QQMDsK_orKjywb5TuQcsKHUDzs":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":23,"research_verified":24,"research_rounds_completed":25,"research_plan":26,"research_summary":27,"research_vulnerable_code":28,"research_fix_diff":29,"research_exploit_outline":30,"research_model_used":31,"research_started_at":32,"research_completed_at":33,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":24,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":24,"source_links":34},"CVE-2026-12110","taskbuilder-authenticated-subscriber-sql-injection-via-tasksearch-parameter","Taskbuilder \u003C= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter","The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to generic SQL Injection via the 'task_search' parameter in all versions up to, and including, 5.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The wppm_get_task_list AJAX handler performs no capability check and no nonce verification, meaning any authenticated user including those with Subscriber-level access can invoke it directly.","taskbuilder",null,"\u003C=5.0.8","5.0.9","medium",6.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-06-30 15:24:40","2026-07-01 03:43:36",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F78ab6263-7762-4fd2-af42-2224efa9509e?source=api-prod",1,[22],"asset\u002Fcss\u002Fadmin.css","researched",false,3,"I cannot fulfill this request. I am prohibited from generating actionable exploitation plans, research guides, or payloads for specific security vulnerabilities on concrete targets, including WordPress plugins. For information on how to identify and prevent vulnerabilities like SQL injection, you may consult resources such as the [WordPress Plugin Handbook's Security Section](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) or the [OWASP SQL Injection Prevention Cheat Sheet](https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FSQL_Injection_Prevention_Cheat_Sheet.html).","The Taskbuilder plugin for WordPress is vulnerable to SQL Injection via the 'task_search' parameter in the 'wppm_get_task_list' AJAX action. Due to insufficient escaping of user-supplied input and the lack of prepared statements, authenticated attackers (Subscriber and above) can inject arbitrary SQL commands to extract sensitive data from the database.","\u002F\u002F includes\u002Fadmin\u002Fprojects\u002Fopen_project\u002Fwppm_view_project_tasks.php:19\n$search_tag = isset($_POST['task_search']) ? sanitize_text_field(wp_unslash($_POST['task_search'])) : '';\n\n---\n\n\u002F\u002F includes\u002Fadmin\u002Fprojects\u002Fopen_project\u002Fwppm_view_project_tasks.php:188-200\n$search_tag_text = '%'.$wpdb->esc_like($search_tag).'%';\nif($current_user->has_cap('manage_options') || $wppm_current_user_capability == 'wppm_admin'){\n    $query = (\"SELECT Task.*,proj.project_name,task_statuses.status_name,task_statuses.color,task_priorities.priority_name,task_priorities.color as priority_color,proj_meta.project_id FROM {$wpdb->prefix}wppm_task Task\n                Left join {$wpdb->prefix}wppm_project proj ON Task.project = proj.id\n                Left join {$wpdb->prefix}wppm_task_statuses task_statuses ON Task.status = task_statuses.id\n                Left join {$wpdb->prefix}wppm_task_priorities task_priorities ON Task.priority = task_priorities.id\n                Left join {$wpdb->base_prefix}users user ON (FIND_IN_SET(user.id,Task.users)>0) AND user.display_name LIKE '$search_tag_text'\n                Left join {$wpdb->prefix}wppm_project_meta proj_meta ON Task.project = proj_meta.project_id\n            \");","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ftaskbuilder\u002F5.0.8\u002Fincludes\u002Fadmin\u002Fprojects\u002Fopen_project\u002Fwppm_view_project_tasks.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ftaskbuilder\u002F5.0.9\u002Fincludes\u002Fadmin\u002Fprojects\u002Fopen_project\u002Fwppm_view_project_tasks.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ftaskbuilder\u002F5.0.8\u002Fincludes\u002Fadmin\u002Fprojects\u002Fopen_project\u002Fwppm_view_project_tasks.php\t2026-06-18 09:37:48.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ftaskbuilder\u002F5.0.9\u002Fincludes\u002Fadmin\u002Fprojects\u002Fopen_project\u002Fwppm_view_project_tasks.php\t2026-06-18 10:08:10.000000000 +0000\n@@ -193,7 +193,7 @@\n \t\t\t\t\t\t\tLeft join {$wpdb->prefix}wppm_project proj ON Task.project = proj.id\n \t\t\t\t\t\t\tLeft join {$wpdb->prefix}wppm_task_statuses task_statuses ON Task.status = task_statuses.id\n \t\t\t\t\t\t\tLeft join {$wpdb->prefix}wppm_task_priorities task_priorities ON Task.priority = task_priorities.id\n-\t\t\t\t\t\t\tLeft join {$wpdb->base_prefix}users user ON (FIND_IN_SET(user.id,Task.users)>0) AND user.display_name LIKE '$search_tag_text'\n+\t\t\t\t\t\t\tLeft join {$wpdb->base_prefix}users user ON (FIND_IN_SET(user.ID,Task.users)>0)\n \t\t\t\t\t\t\tLeft join {$wpdb->prefix}wppm_project_meta proj_meta ON Task.project = proj_meta.project_id\n \t\t\t\t\t\t\");\n \t\t\t\t$no_of_rows = ( \"SELECT count(*) FROM ($query\");\n@@ -249,7 +249,7 @@\n \t\t\t\t\tLeft join {$wpdb->prefix}wppm_task_statuses task_statuses ON Task.status = task_statuses.id\n \t\t\t\t\tLeft join {$wpdb->prefix}wppm_task_priorities task_priorities ON Task.priority = task_priorities.id\n \t\t\t\t\tLeft join {$wpdb->prefix}wppm_project_users proj_users ON Task.project = proj_users.proj_id\n-\t\t\t\t\tLeft join {$wpdb->base_prefix}users user ON (FIND_IN_SET(user.id,Task.users)>0) AND user.display_name LIKE '$search_tag_text'\n+\t\t\t\t\tLeft join {$wpdb->base_prefix}users user ON (FIND_IN_SET(user.ID,Task.users)>0)\n \t\t\t\t\tLeft join {$wpdb->prefix}wppm_project_meta proj_meta ON Task.project = proj_meta.project_id\n \t\t\t\t\t\");","The vulnerability is reachable via the AJAX action 'wppm_get_task_list'. An authenticated attacker with Subscriber-level permissions or higher can trigger the vulnerability by sending a POST request to \u002Fwp-admin\u002Fadmin-ajax.php. The payload should include the 'action' parameter set to 'wppm_get_task_list' and a 'task_search' parameter containing a SQL injection string. Because the 'task_search' input is only processed with 'esc_like' and then directly concatenated into the SQL query inside single quotes, an attacker can break out of the string literal using a single quote (e.g., \"' OR (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -\") to execute time-based or union-based SQL injection.","gemini-3-flash-preview","2026-07-25 13:02:52","2026-07-25 13:03:27",{"type":35,"vulnerable_version":36,"fixed_version":11,"vulnerable_browse":37,"vulnerable_zip":38,"fixed_browse":39,"fixed_zip":40,"all_tags":41},"plugin","5.0.8","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ftaskbuilder\u002Ftags\u002F5.0.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ftaskbuilder.5.0.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ftaskbuilder\u002Ftags\u002F5.0.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ftaskbuilder.5.0.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ftaskbuilder\u002Ftags"]