CVE-2026-1639

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1639", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-29T18:02:14.536Z", "datePublished": "2026-02-18T05:29:16.875Z", "dateUpdated": "2026-04-08T16:44:01.859Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:44:01.859Z"}, "affected": [{"vendor": "taskbuilder", "product": "Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Taskbuilder \u2013 WordPress Project Management & Task Management plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' and 'sort_by' parameters in all versions up to, and including, 5.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "Taskbuilder <= 5.0.2 - Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2cfdde5c-f0e3-4597-9789-3ff0347719c6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/taskbuilder/tags/5.0.2/includes/admin/projects/projects_list.php#L14"}, {"url": "https://plugins.trac.wordpress.org/browser/taskbuilder/tags/5.0.2/includes/admin/projects/projects_list.php#L136"}, {"url": "https://plugins.trac.wordpress.org/browser/taskbuilder/tags/5.0.2/includes/admin/projects/projects_list.php#L138"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Tarc\u00edsio Luchesi De Almeida Silva"}], "timeline": [{"time": "2026-01-30T17:24:15.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-17T17:19:34.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T12:25:20.304481Z", "id": "CVE-2026-1639", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T12:53:16.656Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1639", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-18T12:25:20.304481Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T12:25:21.388Z"}}], "cna": {"title": "Taskbuilder <= 5.0.2 - Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters", "credits": [{"lang": "en", "type": "finder", "value": "Tarc\u00edsio Luchesi De Almeida Silva"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "taskbuilder", "product": "Taskbuilder \u2013 WordPress Project Management & Task Management,kanban view", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "5.0.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-30T17:24:15.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-17T17:19:34.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2cfdde5c-f0e3-4597-9789-3ff0347719c6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/taskbuilder/tags/5.0.2/includes/admin/projects/projects_list.php#L14"}, {"url": "https://plugins.trac.wordpress.org/browser/taskbuilder/tags/5.0.2/includes/admin/projects/projects_list.php#L136"}, {"url": "https://plugins.trac.wordpress.org/browser/taskbuilder/tags/5.0.2/includes/admin/projects/projects_list.php#L138"}], "descriptions": [{"lang": "en", "value": "The Taskbuilder \u2013 WordPress Project Management & Task Management plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' and 'sort_by' parameters in all versions up to, and including, 5.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-18T05:29:16.875Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1639", "state": "PUBLISHED", "dateUpdated": "2026-02-18T12:53:16.656Z", "dateReserved": "2026-01-29T18:02:14.536Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-18T05:29:16.875Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board", "vendor": "taskbuilder", "versions": [{"lessThanOrEqual": "5.0.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Taskbuilder \u2013 WordPress Project Management & Task Management plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' and 'sort_by' parameters in all versions up to, and including, 5.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin Taskbuilder \u2013 WordPress Project Management &amp; Task Management para WordPress es vulnerable a inyecci\u00f3n SQL ciega basada en tiempo a trav\u00e9s de los par\u00e1metros 'order' y 'sort_by' en todas las versiones hasta la 5.0.2, inclusive, debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y a la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, a\u00f1adan consultas SQL adicionales en consultas ya existentes que pueden utilizarse para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2026-1639", "lastModified": "2026-06-17T10:16:14.253", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1639", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-18T12:25:20.304481Z", "version": "2.0.3"}}]}, "published": "2026-02-18T06:16:34.530", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/taskbuilder/tags/5.0.2/includes/admin/projects/projects_list.php#L136"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/taskbuilder/tags/5.0.2/includes/admin/projects/projects_list.php#L138"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/taskbuilder/tags/5.0.2/includes/admin/projects/projects_list.php#L14"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2cfdde5c-f0e3-4597-9789-3ff0347719c6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.0.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Taskbuilder \u2013 WordPress Project Management & Task Management,kanban view", "source": "cna", "vendor": "taskbuilder"}, "product": "taskbuilder_\u2013_wordpress_project_management_&_task_management,kanban_view", "vendor": "taskbuilder"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T20:25:16.157292+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest Taskbuilder plugin version where the SQL injection issue is resolved.", "Limit WordPress subscribers and higher roles from accessing the project list page or remove permissions tied to the 'order' and 'sort_by' abilities.", "Implement a Web Application Firewall rule to block suspicious SQL patterns in the 'order' and 'sort_by' query parameters."], "summary": {"action": "Patch Immediately", "impact": "SQL Injection leading to unauthorized database access"}, "threat_synthesis": {"affected_systems": "All installations of the Taskbuilder \u2013 Project Management & Task Management plugin version 5.0.2 and earlier on any WordPress site are affected. The flaw resides in the admin/projects/projects_list.php file. Any WordPress website that has this plugin enabled and a user with subscriber or higher privileges is at risk.", "description_and_impact": "The plugin contains a time\u2011based blind SQL injection vulnerability in the 'order' and 'sort_by' parameters used in the projects list page. The code fails to escape user input and does not use prepared statements, allowing an authenticated user with subscriber or higher privileges to inject arbitrary SQL into the existing query. This can result in the extraction or modification of sensitive data stored in the WordPress database. The vulnerability is identified as CWE\u201189. Because the attack requires authentication, the scope is limited to users with subscriber-level access and above.", "risk_and_exploitability": "The CVSS score of 6.5 reflects moderate severity, and the EPSS score of less than 1% indicates exploitation is currently unlikely. The vulnerability is not listed in CISA's KEV catalog. Because it is a blind, time\u2011based injection, an attacker would need to observe response delays to infer data, making the attack more complex but still feasible for a determined, authenticated attacker who can bypass role restrictions. The likelihood of exploitation is low, but the confidentiality impact is high if the attacker succeeds."}}}}, "created": "2026-02-18T10:32:48.078583+00:00", "updated": "2026-04-15T20:30:13.779390+00:00", "vendors": ["taskbuilder", "taskbuilder$PRODUCT$taskbuilder_\u2013_wordpress_project_management_&_task_management,kanban_view", "wordpress", "wordpress$PRODUCT$wordpress"]}