The vulnerability arises from improper neutralization of special elements in an SQL command. Attackers can inject crafted SQL through the Taskbuilder plugin, leading to blind SQL injection. This flaw allows unauthorized read, modification, or deletion of data stored within the WordPress database, potentially enabling sensitive information disclosure or persistence of malicious code.

The affected product is the WordPress Taskbuilder plugin for the Taskbuilder:Taskbuilder vendor. All installations running version 4.0.1 or earlier are vulnerable; no specific minimum version is excluded.

The CVSS score of 8.5 classifies the flaw as high‑severity, while the EPSS score of less than 1% indicates a very low or near‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to send specially crafted HTTP requests to the WordPress site hosting the plugin; the blind nature of the injection suggests that authentication is not strictly required, though the exact prerequisites are not disclosed. Notably, the low EPSS does not eliminate the need for remediation.