CVE-2026-52697
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
There is a SQL Injection vulnerability in Taskbuilder versions <= 5.0.7 that can be exploited by subscribers.
Risk Assessment
An attacker could gain access to sensitive data in the database, potentially leading to serious security breaches.
Recommendation
It is recommended to upgrade to the latest version of Taskbuilder to mitigate this vulnerability.
Other vulnerabilities in Taskbuilder
See all- CVE-2026-12110Medium
The Taskbuilder plugin for WordPress up to version 5.0.8 is vulnerable to generic SQL injection via the 'task_search' parameter due to insufficient escaping and lack of query preparation. Authenticated attackers with subscriber-level access or higher can append malicious SQL queries.
- CVE-2026-12090Medium
The Taskbuilder plugin for WordPress is vulnerable to generic SQL injection via the 'wppm_proj_filter' parameter in versions up to 5.0.8. Insufficient escaping and lack of query preparation allow authenticated attackers (subscriber-level and above) to append additional SQL queries, enabling extraction of sensitive database information.
Original NVD description (English source)
Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.