{"id":"CVE-2026-95599","published":"2026-10-09T10:16:42.780","lastModified":"2026-10-09T21:17:07.620","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Taskbuilder taskbuilder allows Blind SQL Injection.This issue affects Taskbuilder: from n/a through 6.0.5.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/taskbuilder/vulnerability/wordpress-taskbuilder-plugin-6-0-5-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This SQL injection vulnerability allows attackers to perform blind SQL injection attacks against Taskbuilder's database by improperly handling user input in SQL commands. This can lead to unauthorized data access and potential database compromise.","exploitability":"Exploitation requires a low-privileged user account and is moderately difficult, requiring time-consuming blind injection techniques to extract data through error responses or timing variations.","blast_radius":"If exploited, this vulnerability could allow attackers to access sensitive task data, user information, and potentially escalate privileges within the Taskbuilder system.","remediation":"Upgrade to version 6.0.6 or later to remediate this SQL injection vulnerability.","detection":"Monitor for unusual database query patterns or extended query execution times that may indicate blind SQL injection attempts in application logs.","tags":["sql-injection","database","blind-injection"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:56:14.536Z"}}