The plugin contains a time‑based blind SQL injection vulnerability in the 'order' and 'sort_by' parameters used in the projects list page. The code fails to escape user input and does not use prepared statements, allowing an authenticated user with subscriber or higher privileges to inject arbitrary SQL into the existing query. This can result in the extraction or modification of sensitive data stored in the WordPress database. The vulnerability is identified as CWE‑89. Because the attack requires authentication, the scope is limited to users with subscriber-level access and above.

All installations of the Taskbuilder – Project Management & Task Management plugin version 5.0.2 and earlier on any WordPress site are affected. The flaw resides in the admin/projects/projects_list.php file. Any WordPress website that has this plugin enabled and a user with subscriber or higher privileges is at risk.

The CVSS score of 6.5 reflects moderate severity, and the EPSS score of less than 1% indicates exploitation is currently unlikely. The vulnerability is not listed in CISA's KEV catalog. Because it is a blind, time‑based injection, an attacker would need to observe response delays to infer data, making the attack more complex but still feasible for a determined, authenticated attacker who can bypass role restrictions. The likelihood of exploitation is low, but the confidentiality impact is high if the attacker succeeds.