PT-2024-39870 · WordPress · Taskbuilder

Ryoma Yamada · Published 2024-11-21 · Updated 2026-01-09 · CVE-2024-9828

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Taskbuilder WordPress plugin versions prior to 3.0.5

Description The issue allows high privilege users, such as admins, to perform SQL Injection attacks due to the lack of sanitization of user input into the load orders parameter, which is then used in a SQL statement.

Recommendations For versions prior to 3.0.5, update to version 3.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the load orders parameter to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-9828

Affected Products

Taskbuilder

References · 5

• 🔥 https://wpscan.com/vulnerability/eb2d0932-fd47-4aef-9d08-4377c742bb6e · Exploit
• https://osv.dev/vulnerability/CVE-2024-9828 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9828 · Security Note
• https://twitter.com/CVEnew/status/1859601793325596900 · Twitter Post
• https://t.me/cveNotify/148307 · Telegram Post