CVE-2026-1639

Name of the Vulnerable Software and Affected Versions Taskbuilder – WordPress Project Management & Task Management plugin versions prior to 5.0.3

Description The Taskbuilder plugin for WordPress is susceptible to a time-based blind SQL injection. This is due to inadequate input sanitization of user-supplied parameters and insufficient query preparation. Specifically, the order and sort by parameters are vulnerable. Authenticated attackers with subscriber-level access or higher can inject additional SQL queries into existing database queries, potentially extracting sensitive information.

Recommendations Update the Taskbuilder – WordPress Project Management & Task Management plugin to version 5.0.3 or later.