CVE-2026-12090 describes an SQL Injection vulnerability in the Taskbuilder – Project Management & Task Management Tool With Kanban Board WordPress plugin. The issue arises from improper neutralization of special elements in the 'wppm_proj_filter' parameter, which is used in SQL queries without sufficient escaping or preparation. The wp_ajax_wppm_view_project_tasks AJAX handler lacks nonce verification, enabling any authenticated user with subscriber-level privileges or higher to exploit the vulnerability. This can lead to unauthorized extraction of sensitive information from the database. The vulnerability affects all versions up to and including 5.0.8. No official patch or remediation level has been provided as of the published date.

An attacker with authenticated access at subscriber level or above can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive data from the database. The vulnerability does not impact data integrity or availability but compromises confidentiality. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for suspicious activity. Implementing additional input validation and nonce verification on the affected AJAX handler could mitigate exploitation risk.