CVE-2026-4004 is a code injection vulnerability in the eoxia Task Manager WordPress plugin affecting all versions up to 3.0.2. The issue arises from missing capability checks in the callback_search() function and inadequate sanitization that permits shortcode syntax (square brackets) to bypass sanitize_text_field(). This input is then concatenated into a do_shortcode() call, enabling authenticated attackers with Subscriber-level privileges or higher to execute arbitrary shortcodes by injecting shortcode syntax into parameters such as 'task_id', 'point_id', 'categories_id', or 'term'.

An attacker with at least Subscriber-level access can execute arbitrary shortcodes on the affected WordPress site, potentially leading to unauthorized actions or information disclosure depending on the shortcodes executed. The vulnerability does not require user interaction and has a network attack vector. The CVSS score of 6.5 reflects a medium severity impact with limited confidentiality and integrity impact and no availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access where possible and monitor for suspicious shortcode usage in AJAX requests related to the 'search' action. Avoid granting unnecessary privileges to users and consider disabling or replacing the affected plugin if feasible.