CVE-2026-2351: 
WordPress vulnerability analysis and mitigation

CVE-2026-2351 is an Arbitrary File Read vulnerability in the Task Manager plugin for WordPress, affecting all versions up to and including 3.0.2. The flaw exists in the callback_get_text_from_url() function and allows authenticated attackers with Subscriber-level access or higher to read arbitrary files on the server. It was published on March 21, 2026, and assigned a CVSS v3.1 base score of 6.5 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-73 (External Control of File Name or Path), with path traversal characteristics (CWE-22) also estimated. The vulnerable callback_get_text_from_url() function in the plugin's import action class (module/import/action/class-import-action.php, line 203) accepts user-supplied input without adequate validation or restriction, allowing an attacker to specify arbitrary file paths on the server. Exploitation requires only a low-privilege authenticated session (Subscriber-level), and the attack is conducted over the network with low complexity and no user interaction required (Wordfence, WordPress Plugin Trac).

Successful exploitation allows an authenticated attacker to read the contents of arbitrary files on the web server, including sensitive configuration files such as wp-config.php (which contains database credentials), environment files, or other server-side secrets. This can lead to credential theft, further lateral movement within the hosting environment, and potential full site compromise if database or administrative credentials are exposed. There is no integrity or availability impact; the vulnerability is limited to confidentiality (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-2351 as of the available data. The EPSS score is approximately 0.03%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Subscriber-level WordPress account, which somewhat limits the attack surface but does not eliminate risk on sites with open registration (Wordfence, Feedly).

1. Reconnaissance: Identify WordPress sites running the Task Manager plugin (versions ≤3.0.2) using tools like WPScan or by checking /wp-content/plugins/task-manager/ for plugin presence.
2. Obtain low-privilege credentials: Register or obtain a Subscriber-level (or higher) WordPress account on the target site.
3. Authenticate: Log in to the WordPress site and obtain a valid session cookie or authentication nonce.
4. Craft malicious request: Send an authenticated HTTP request to the endpoint that invokes callback_get_text_from_url(), supplying a crafted file path (e.g., ../../../../wp-config.php or /etc/passwd) as the URL parameter instead of a legitimate URL.
5. Retrieve sensitive file contents: The function reads and returns the contents of the specified file, exposing credentials, configuration data, or other sensitive server-side information to the attacker (Wordfence, WordPress Plugin Trac).

• Network: Unusual authenticated HTTP requests to WordPress AJAX or admin endpoints associated with the Task Manager plugin's import functionality, particularly with file path patterns (e.g., ../, /etc/, wp-config) in request parameters.
• Logs: WordPress or web server access logs showing repeated POST/GET requests to wp-admin/admin-ajax.php or similar endpoints with suspicious url parameter values containing path traversal sequences from low-privilege user accounts.
• File System: No direct file system artifacts are expected from a read-only exploit, but evidence of subsequent actions (e.g., new admin accounts, modified files) may indicate follow-on activity after credential theft via this vulnerability.

As of the disclosure date (March 21, 2026), no patched version beyond 3.0.2 was confirmed available. Site administrators should consider deactivating and removing the Task Manager plugin until a patched version is released. As a compensating control, restrict WordPress user registration to prevent untrusted users from obtaining Subscriber-level accounts. Monitor the official WordPress plugin repository for an updated version (Wordfence, WordPress Plugin Page).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for the week of March 16–22, 2026, noting it as one of multiple plugin vulnerabilities identified during that period (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified.