CVE-2026-12090

Name of the Vulnerable Software and Affected Versions Taskbuilder – Project Management & Task Management Tool With Kanban Board versions prior to 5.0.9

Description An issue exists where authenticated users with subscriber-level access and above can perform a SQL Injection. This occurs because the wppm proj filter parameter is not sufficiently escaped and the SQL query is not properly prepared. Attackers can append additional SQL queries to extract sensitive information from the database. The vulnerability is reachable via the wp ajax wppm view project tasks handler, which lacks nonce verification (a security token used to prevent cross-site request forgery).

Recommendations Update to a version newer than 5.0.8. Avoid using the wppm proj filter parameter in the wp ajax wppm view project tasks handler until the update is applied.