CVE-2026-1639

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Taskbuilder – WordPress Project Management & Task Management plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' and 'sort_by' parameters in all versions up to, and including, 5.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Feb 18, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-163909.1Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, anCVE-2026-163917.5Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153CVE-2026-163929.1JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.CVE-2026-163939.1Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.CVE-2026-163949.1Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.CVE-2026-163959.8Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.CVE-2026-163968.8Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140CVE-2026-163976.5Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.CVE-2026-163987.5Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.CVE-2026-163997.5Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.CVE-2026-16404.3The Taskbuilder – WordPress Project Management & Task Management plugin for WordPress is vulnerable to authorization bypass in all versions CVE-2026-164007.5Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.