CVE-2026-6225 is a time-based blind SQL Injection vulnerability in the Taskbuilder – Project Management & Task Management Tool With Kanban Board WordPress plugin, affecting all versions up to 5.0.6. The issue occurs due to improper neutralization of special elements in the 'project_search' parameter, allowing authenticated users with at least Subscriber privileges to inject additional SQL commands. This vulnerability enables attackers to extract sensitive information from the database without impacting data integrity or availability. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

An attacker with Subscriber-level access or higher can exploit this vulnerability to perform time-based blind SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect data integrity or availability but compromises confidentiality. Because the attack requires authenticated access, the risk is limited to users who already have some level of access to the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level user permissions where possible and monitor for suspicious activity related to the 'project_search' parameter. Avoid granting unnecessary access to untrusted users. No official patch or workaround is currently documented.