CVE-2026-15267 describes an SQL Injection vulnerability in the Taskbuilder – Project Management & Task Management Tool With Kanban Board WordPress plugin. The issue stems from insufficient escaping of the 'wppm_proj_filter' parameter, which is sanitized using sanitize_text_field() and esc_sql() but then improperly concatenated into a SQL WHERE clause as an unquoted numeric operand. This bypasses the intended parameterization of $wpdb->prepare(), enabling attackers with subscriber-level privileges to append arbitrary SQL queries. This vulnerability affects versions up to and including 5.0.9. There is no vendor advisory or patch information available at this time.

An authenticated attacker with subscriber-level access or higher can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact integrity or availability directly but poses a confidentiality risk by allowing unauthorized data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user privileges where possible and monitor for unusual database activity related to the 'wppm_proj_filter' parameter. Avoid relying solely on sanitize_text_field() and esc_sql() for SQL query construction in this context.