CVE-2026-52697 HIGH

CVE-2026-52697: WordPress Taskbuilder plugin <= 5.0.7 - SQL Injection vulnerability

Vendor Taskbuilder
Product Taskbuilder
Weakness CWE-89 · SQLi
Published June 15, 2026
Last update June 16, 2026
View on NVD All CVEs

CVSS base score

8.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

What the vulnerability does

01Description

Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Taskbuilder versions up to 5.0.7 contain a SQL injection vulnerability in a network-accessible function that requires low-level authentication. An attacker with a valid user account can inject malicious SQL commands to read sensitive data from the database. The vulnerability affects confidentiality severely and can also degrade system availability. Update to version 5.0.8 or later.

What an attacker can do

03Attacker Capabilities

Read sensitive data from the database and potentially degrade system performance.

Potential impact on your site

04Site Impact

Unauthorized access to database contents; potential data breach and service disruption.

Conditions required to exploit

05Prerequisites

Attacker must have a valid Taskbuilder user account with low-level privileges.

Key dates

06Disclosure timeline

June 15, 2026 CVE published
June 16, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-12077 Dokan Pro <= 5.0.4 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters CVE-2025-69094 WordPress Unicamp theme <= 2.2.2 - SQL Injection vulnerability CVE-2026-39574 WordPress InPost Gallery plugin <= 2.1.4.6 - SQL Injection vulnerability CVE-2026-12110 Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter CVE-2026-49772 WordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerability