The Taskbuilder plugin for WordPress contains a generic SQL injection flaw in the 'task_search' parameter of the wppm_get_task_list AJAX handler. The vulnerability arises because the plugin does not escape user input and does not use prepared statements, allowing an attacker to append arbitrary SQL code. Because the handler performs no capability check or nonce verification, any authenticated user with subscriber-level access or higher can trigger the weakness, leaking sensitive database content such as user credentials and project data. This flaw is classified as CWE‑89.

All WordPress sites running Taskbuilder version 5.0.8 or earlier are vulnerable. The risky endpoint resides in the AJAX handler that lists tasks, and any user with subscriber or higher role can invoke it. Sites that use this plugin and have registered users are therefore at risk.

The vulnerability carries a CVSS score of 6.5, which is considered medium severity. EPSS data is not available, and the issue is not listed in CISA KEV. Attackers need only a valid authenticated account, so exploitation is straightforward for anyone with subscriber access. The potential for data exfiltration is significant because the injected SQL can read arbitrary tables.