CVE-2026-15267 in Taskbuilder Plugin
Summary
by MITRE • 07/28/2026
The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL Injection via the 'wppm_proj_filter' parameter in versions up to, and including, 5.0.9. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query — the value is re-read at line 144 using only sanitize_text_field() (overwriting the earlier absint() result), then concatenated into the SQL WHERE clause as an unquoted numeric operand using only esc_sql(), which does not protect against injection in that context, and finally string-interpolated into the $wpdb->prepare() format string, bypassing parameterization entirely. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability in the Taskbuilder WordPress plugin represents a critical sql injection flaw that undermines the integrity of the underlying database system. This weakness resides within the plugin's handling of the wppm_proj_filter parameter, which is processed through an insecure chain of sanitization functions that fail to provide adequate protection against malicious input. The vulnerability affects versions up to and including 5.0.9, making it a widespread concern for WordPress installations utilizing this project management tool.
The technical implementation of this vulnerability demonstrates a fundamental flaw in the plugin's data validation and query construction methodology. At line 144, the code applies sanitize_text_field() which, while designed to sanitize text input, fails to properly handle numeric contexts where integer values are expected. This sanitization overwrites the earlier absint() conversion that would have properly cast the parameter to an integer, effectively nullifying the initial security measure. The subsequent use of esc_sql() for database escaping proves insufficient as this function only escapes special characters for sql contexts but does not provide protection against injection when used in unquoted numeric operands within prepared statements.
The operational impact of this vulnerability extends beyond simple data exposure, as it allows authenticated attackers with subscriber-level privileges to manipulate existing sql queries through carefully crafted input. The vulnerability exploits the improper concatenation of user-supplied values into sql WHERE clauses without proper parameterization, enabling attackers to append additional sql commands that can be executed within the context of the database connection. This creates a pathway for information disclosure attacks where sensitive data including user credentials, project details, and other confidential information could be extracted from the database through maliciously constructed queries.
Security professionals should recognize this vulnerability as a classic example of insufficient input validation combined with improper sql query construction techniques that aligns with common weakness enumerations such as cwe-89 sql injection. The attack vector is particularly concerning because it requires only subscriber-level access, making it accessible to users who may not have elevated privileges but can still manipulate database queries through the vulnerable parameter. This vulnerability also demonstrates characteristics consistent with attack techniques described in the mitre att&ck framework under the data extraction and privilege escalation categories.
The recommended mitigation strategy involves immediate plugin updates to versions that address this sql injection vulnerability through proper input validation, parameterized query construction, and elimination of the insecure sanitization sequence. Administrators should implement additional security measures including wp role management to restrict unnecessary subscriber access to project management functions, database query monitoring to detect anomalous sql patterns, and regular security audits of installed plugins to identify similar vulnerabilities. The fix should ensure that all user-supplied parameters are properly validated as integers before being incorporated into sql queries, with appropriate parameterization techniques that prevent any form of injection regardless of input type or context.