CVE-2026-12110 describes an SQL Injection vulnerability in the Taskbuilder – Project Management & Task Management Tool With Kanban Board WordPress plugin. The issue arises from improper neutralization of special elements in the 'task_search' parameter, which is used in SQL queries without sufficient escaping or preparation. The AJAX handler 'wppm_get_task_list' lacks capability checks and nonce verification, enabling any authenticated user, including those with subscriber-level privileges, to exploit this flaw to append arbitrary SQL commands and extract sensitive data from the database.

An attacker with subscriber-level or higher authenticated access can exploit this vulnerability to perform unauthorized SQL queries on the backend database. This can lead to disclosure of sensitive information stored in the database. The vulnerability does not impact data integrity or availability directly, but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles that can access the vulnerable AJAX handler and monitor for suspicious activity. Implement additional input validation and capability checks if possible.