The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin allows an authenticated user with subscriber-level or higher permissions to exploit a classic SQL injection flaw through the 'wppm_proj_filter' parameter. Insufficient sanitization combined with string interpolation into a non-parameterized query enables an attacker to append and execute arbitrary SQL statements, potentially exposing sensitive database information. The weakness is a classic input validation failure classified as CWE‑89.

Any WordPress site that has installed Taskbuilder version 5.0.9 or earlier and permits subscriber or higher role users to access the plugin’s project task features is vulnerable.

The flaw carries a CVSS score of 6.5, indicating a medium severity risk. The EPSS score of less than 1% suggests the likelihood of exploitation is currently low, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must be authenticated with at least subscriber role and can manipulate a numeric parameter that bypasses parameterization, thereby posing a threat of unauthorized data extraction from the database.