What the vulnerability does
01Description
The Task Manager plugin for WordPress is vulnerable to arbitrary shortcode execution via the 'search' AJAX action in all versions up to, and including, 3.0.2. This is due to missing capability checks in the callback_search() function and insufficient input validation that allows shortcode syntax (square brackets) to pass through sanitize_text_field() and be concatenated into a do_shortcode() call. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes on the site by injecting shortcode syntax into parameters like 'task_id', 'point_id', 'categories_id', or 'term'.
Explanation of Vulnerability in Simple Terms
02Summary
Task Manager versions 3.0.2 and earlier contain a code injection vulnerability that allows unauthenticated attackers to inject and execute arbitrary code over the network. No user interaction is required. The vulnerability affects code confidentiality and integrity but not availability. Update to a version newer than 3.0.2 immediately.
What an attacker can do
03Attacker Capabilities
Inject and execute arbitrary code on the site without authentication.
Potential impact on your site
04Site Impact
Attackers can read sensitive data and modify site content or functionality without logging in.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
March 21, 2026
CVE published
April 8, 2026
Record updated
