CVE-2026-12110

Name of the Vulnerable Software and Affected Versions Taskbuilder – Project Management & Task Management Tool With Kanban Board versions prior to 5.0.9

Description An issue exists where authenticated attackers with subscriber-level access and above can perform SQL Injection. This occurs because the task search parameter is not sufficiently escaped and the SQL query is not properly prepared. Additionally, the wppm get task list() AJAX handler lacks capability checks and nonce verification, allowing any authenticated user to invoke it directly and append malicious SQL queries to extract sensitive information from the database.

Recommendations Update Taskbuilder – Project Management & Task Management Tool With Kanban Board to version 5.0.9 or later.