CVE-2026-95599: WordPress Taskbuilder plugin <= 6.0.5 - SQL Injection vulnerability

Q: Who can exploit this vulnerability?

The CVSS vector indicates that exploitation is network-accessible, requires low privileges, and does not require user interaction. An attacker would need an account or other low-level authenticated access, but no victim action is required.

Q: Which installations are affected?

Taskbuilder versions through 6.0.5 are affected. The available data does not state whether a particular WordPress configuration or feature must be enabled.

Q: What is the potential impact?

The issue allows blind SQL injection. The supplied severity vector indicates high confidentiality impact, no integrity impact, and low availability impact, with effects potentially extending beyond the vulnerable component's security scope.

Published Oct 9, 2026

Updated

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Taskbuilder taskbuilder allows Blind SQL Injection.This issue affects Taskbuilder: from n/a through 6.0.5.

Affected Software

1 affected component

Taskbuilder Taskbuilder<=6.0.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Taskbuilder plugin to a version that resolves this vulnerability.
Fixed in 6.0.6

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

The CVSS vector indicates that exploitation is network-accessible, requires low privileges, and does not require user interaction. An attacker would need an account or other low-level authenticated access, but no victim action is required.

Which installations are affected?

Taskbuilder versions through 6.0.5 are affected. The available data does not state whether a particular WordPress configuration or feature must be enabled.

What is the potential impact?

The issue allows blind SQL injection. The supplied severity vector indicates high confidentiality impact, no integrity impact, and low availability impact, with effects potentially extending beyond the vulnerable component's security scope.

CVE-2026-95599: WordPress Taskbuilder plugin <= 6.0.5 - SQL Injection vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

Which installations are affected?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

Which installations are affected?

What is the potential impact?