Taskbot WordPress plugin: Unauthenticated privilege escalation
Summary
Taskbot WordPress plugin versions up to and including 6.6 contain an unauthenticated privilege escalation flaw (CWE-266). A remote attacker without an account can gain elevated rights on the WordPress site, which can lead to full administrative control. The CVSS base score is 9.8 (critical). No vendor patch is available according to Patchstack, and no fixed version has been confirmed.
Affected
- Taskbot WordPress plugin, versions <= 6.6 (AmentoTech)
- Default configuration: unaffected according to the CNA record, which lists the affected range as <= 6.6
Fixed in
- Unknown. Patchstack reports no official patch available.
- Do not infer a fixed version. Check the installed version against the vendor update channel (CodeCanyon).
Workaround
- Deactivate and remove the plugin if the marketplace functionality is not needed.
- If the plugin must stay online, place the site behind a WAF or apply a virtual patch (Patchstack has published a mitigation rule).
- Restrict or disable public user registration where the business allows it.
- Audit WordPress administrator accounts and recent role changes for unknown users.
Exploitation
- Not known to be exploited in the wild according to the sources reviewed (CISA SSVC: Exploitation none).
- Patchstack rates the flaw as high priority and expects exploitation; it is automatable.
- No public proof of concept was found in the research; this does not rule out that one exists.
Our recommendation
- Inventory all WordPress sites for the Taskbot plugin and record the exact version, including whether it is active.
- If Taskbot is installed and running, deactivate it or apply the Patchstack mitigation rule immediately.
- Check administrator accounts and role changes for unknown users, and review the site for unexpected plugin or file changes.
- Monitor the Patchstack entry and the vendor page for an official fix and re-check exploitation status regularly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack: WordPress Taskbot plugin <= 6.6 Privilege Escalation patchstack.com
- HOL Guard: CVE-2026-39753 Taskbot privilege escalation hol.org
- Strix: CVE-2026-39753 www.strix.ai
- WPScan: Taskbot <= 6.6 Unauthenticated Privilege Escalation wpscan.com
- CodeCanyon: Taskbot - A Freelancer Marketplace WordPress Plugin codecanyon.net
- AmentoTech Ticksy support amentotech.ticksy.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:12.
Original description (NVD)
Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.