CVE-2026-1640
Authorization Bypass in Taskbuilder Plugin Allows Comment Injection
Publication date: 2026-02-18
Last updated on: 2026-02-18
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| taskbuilder | taskbuilder | to 5.0.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the Taskbuilder WordPress plugin (up to version 5.0.2) is an authorization bypass issue affecting the project and task comment submission functions. Authenticated users with subscriber-level access or higher can exploit missing authorization checks to create comments on any project or task, including private ones they should not access.
Additionally, attackers can inject arbitrary HTML and CSS through the insufficiently sanitized comment_body parameter, potentially leading to cross-site scripting (XSS) or other injection attacks.
How can this vulnerability impact me? :
This vulnerability allows unauthorized users with minimal access to post comments on any project or task, including private ones they are not assigned to or cannot view.
Such unauthorized comment creation can lead to information disclosure, manipulation of project data, and injection of malicious HTML or CSS, which could be used for phishing, defacement, or other attacks against users of the affected WordPress site.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability involves unauthorized comment submissions via AJAX actions 'wppm_submit_proj_comment' and 'wppm_submit_task_comment' in the TaskBuilder WordPress plugin. Detection can focus on monitoring AJAX requests to these endpoints for suspicious activity, such as comment submissions from users with subscriber-level access or unusual HTML/CSS injection attempts in the 'comment_body' parameter."}, {'type': 'paragraph', 'content': 'You can detect exploitation attempts by inspecting HTTP POST requests to the AJAX endpoints related to project and task comment submissions. For example, using command-line tools like curl or network monitoring tools to capture and analyze traffic.'}, {'type': 'list_item', 'content': 'Use a command to monitor HTTP POST requests to the WordPress AJAX handler with the specific actions, e.g.:'}, {'type': 'list_item', 'content': "curl -X POST -d 'action=wppm_submit_proj_comment&comment_body=<payload>&proj_id=<id>' https://yourwordpresssite.com/wp-admin/admin-ajax.php"}, {'type': 'list_item', 'content': "curl -X POST -d 'action=wppm_submit_task_comment&comment_body=<payload>&task_id=<id>' https://yourwordpresssite.com/wp-admin/admin-ajax.php"}, {'type': 'paragraph', 'content': "Additionally, you can search your web server logs for POST requests to 'admin-ajax.php' with these actions and review the 'comment_body' parameter for suspicious HTML or CSS content."}] [1, 2]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The immediate mitigation step is to update the TaskBuilder WordPress plugin to a version later than 5.0.2 where this authorization bypass vulnerability is fixed.'}, {'type': 'paragraph', 'content': "If an update is not immediately possible, consider restricting access to the AJAX actions 'wppm_submit_proj_comment' and 'wppm_submit_task_comment' to only trusted user roles or disabling comment submissions temporarily."}, {'type': 'paragraph', 'content': 'Additionally, monitor and audit comment submissions for unauthorized or suspicious activity, and consider implementing additional server-side authorization checks or web application firewall (WAF) rules to block unauthorized AJAX requests targeting these actions.'}] [1, 2]