Taskbuilder WordPress plugin: Blind SQL injection
Summary
The Taskbuilder WordPress plugin up to version 6.0.5 is affected by a blind SQL injection vulnerability (CWE-89). An authenticated attacker with low privileges, such as a Subscriber account, may be able to read or modify database content over the network. Patchstack rates the issue as high priority, but no public exploitation is known and the fixed version could not be confirmed.
Affected
- Taskbuilder WordPress plugin, versions up to and including 6.0.5 (according to the CVE record; the version range is unverified because other Taskbuilder advisories use 5.0.x numbering)
- Required privilege: Subscriber (according to Patchstack)
Fixed in
- Unknown. Patchstack lists 6.0.6 as the patched version, but this could not be independently verified.
- Update to the newest available version and check the vendor changelog for SQL injection fixes.
Workaround
- Deactivate the plugin if it is not essential.
- Restrict account registration and review accounts with Subscriber-level access.
- Use WAF virtual patching if available (Patchstack offers a mitigation rule).
Exploitation
- No known exploitation in the wild; not listed in CISA KEV.
- No public proof of concept found.
- EPSS score 0.00205 (low).
- CISA SSVC: exploitation none, not automatable, partial technical impact.
Our recommendation
- Identify all WordPress sites running Taskbuilder and record the installed version.
- Deactivate Taskbuilder where it is not needed; where needed, update to the newest version (at least 6.0.6 according to Patchstack) and verify the fix.
- Remove unused Subscriber-level accounts.
- Monitor for slow responses on plugin endpoints and unusual POST requests to Taskbuilder AJAX actions.
- Re-check the NVD record and the Patchstack page for a confirmed affected range and fixed version.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack: WordPress Taskbuilder plugin <= 6.0.5 SQL Injection patchstack.com
- Strix: CVE-2026-95599 www.strix.ai
- Vulners: RAPID7 CVE-2026-95599 vulners.com
- Wordfence: Taskbuilder authenticated Subscriber SQL injection www.wordfence.com
- Patchstack: WordPress Taskbuilder plugin <= 5.0.7 SQL Injection patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:04.
Original description (NVD)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Taskbuilder taskbuilder allows Blind SQL Injection.This issue affects Taskbuilder: from n/a through 6.0.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.