The Taskbuilder plugin for WordPress is vulnerable to a time‑based blind SQL injection that allows an authenticated subscriber or higher to inject and execute additional SQL statements. Because the plugin does not escape the project_search input or prepare the query, attackers can retrieve arbitrary data from the database, resulting in confidential information disclosure.

The vulnerability affects the ‘Taskbuilder – Project Management & Task Management Tool With Kanban Board’ WordPress plugin in all releases up to and including version 5.0.6. No other versions are listed as impacted.

The CVSS score of 6.5 indicates moderate severity, and the lack of an EPSS score or KEV listing suggests that the vulnerability is not widely exploited. However, the attack requires valid Subscriber credentials, so the exposure is limited to authorized users who can trigger the project_search parameter. The attack vector is internal web application, and the attacker must have network access to the WordPress site.