CVE-2025-22716 WordPress Taskbuilder Plugin <= 3.0.6 - SQL Injection vulnerability
An attacker can exploit SQL injection in the Taskbuilder WordPress plugin to read or modify database contents.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-22716?
CVE-2025-22716 is a high-severity SQL injection vulnerability in Taskbuilder, published on 21 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in taskbuilder Taskbuilder taskbuilder allows SQL Injection.This issue affects Taskbuilder: from n/a through <= 3.0.6.
Weakness: CWE-89
Which versions are affected by CVE-2025-22716?
It affects 1 product.
Products include Taskbuilder Taskbuilder.
How do I fix CVE-2025-22716?
No fix has been published for CVE-2025-22716 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-22716 being exploited?
There is no known exploitation of CVE-2025-22716 in the wild and no public exploit code.
Other vulnerabilities in Taskbuilder
- CVE-2024-9831 Taskbuilder < 3.0.9 - Admin+ SQL Injection
- CVE-2024-11930 Cross-site scripting in Taskbuilder – Project Management & Task Management Tool With Kanban Board
- CVE-2022-3137 TaskBuilder < 1.0.8 - Subscriber+ Stored XSS via SVG file upload
- CVE-2024-9828 Taskbuilder < 3.0.5 - Admin+ SQL Injection
Sources
Also known as GHSA-rj76-j4fr-rh37.