Description
Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.
Published: 2026-10-06
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch Immediately
AI Analysis

Impact

An arbitrary file upload flaw exists in the Taskbot WordPress plugin for versions 6.6 and earlier. The flaw allows an attacker to upload any file to the server via the plugin’s upload interface, and if that file is executable, the attacker can run arbitrary code on the web server. This vulnerability corresponds to CWE‑434 and can lead to complete site compromise.

Affected Systems

The affected product is the AmentoTech Taskbot plugin for WordPress, including all releases up to and including version 6.6. No specific patch release is listed here, so any installation of the plugin at or below this version is vulnerable.

Risk and Exploitability

The CVSS score of 9.9 indicates a critical level of severity, and the EPSS score is < 1%. The vulnerability is not yet listed in CISA’s KEV catalog. The description does not specify whether authentication is required to exploit the upload interface; thus the attack could be feasible for anyone able to access the upload page or for users with sufficient privileges. Given the presence of arbitrary code execution, the risk is substantial when the flaw is exploitable.

Generated by OpenCVE AI on October 7, 2026 at 05:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Taskbot plugin to the latest release that removes the arbitrary file upload flaw.
  • If the plugin cannot be updated, disable or delete it from the WordPress installation to eliminate the attack surface.
  • Configure the web server or CMS settings to restrict uploaded content to approved file types and prevent execution of uploaded files, for example by setting appropriate MIME type checks and file permissions.

Generated by OpenCVE AI on October 7, 2026 at 05:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.
Title WordPress Taskbot plugin <= 6.6 - Arbitrary File Upload vulnerability
Weaknesses CWE-434
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-06T10:31:37.577Z

Reserved: 2026-04-07T10:58:58.454Z

Link: CVE-2026-39757

cve-icon Vulnrichment

Updated: 2026-10-06T10:30:11.591Z

cve-icon NVD

Status : Deferred

Published: 2026-10-06T09:17:47.553

Modified: 2026-10-06T15:04:25.990

Link: CVE-2026-39757

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T05:30:13Z

Weaknesses
  • CWE-434

    Unrestricted Upload of File with Dangerous Type