CVE-2026-4126
Received Received - Intake

Sensitive Information Exposure in WordPress Table Manager Plugin

Publication date: 2026-04-22

Last updated on: 2026-04-22

Assigner: Wordfence

Description
The Table Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0 via the 'table_manager' shortcode. The shortcode handler `tablemanager_render_table_shortcode()` takes a user-controlled `table` attribute, applies only `sanitize_key()` for sanitization, and concatenates the value with `$wpdb->prefix` to form a full database table name. It then executes `DESC` and `SELECT *` queries against this table and renders all rows and columns to the frontend. There is no allowlist check to ensure only plugin-created tables can be accessed — the `tablemanager_created_tables` option is only referenced in admin functions, never in the shortcode handler. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data from arbitrary WordPress database tables.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-04-22
Last Modified
2026-04-22
Generated
2026-07-06
AI Q&A
2026-04-22
EPSS Evaluated
2026-07-05
NVD
CVE-2026-4126
EUVD
EUVD-2026-24668

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wordfence table_manager to 1.0.0 (inc)
table_manager table_manager to 1.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Table Manager plugin for WordPress has a vulnerability in its shortcode handler 'tablemanager_render_table_shortcode()'. This handler takes a user-controlled 'table' attribute and only applies minimal sanitization using 'sanitize_key()'. It then concatenates this value with the WordPress database prefix to form a table name and executes database queries (DESC and SELECT *) on that table.

Because there is no allowlist check to ensure that only plugin-created tables can be accessed, authenticated users with Contributor-level access or higher can exploit this to extract sensitive data from arbitrary WordPress database tables.

Impact Analysis

This vulnerability allows authenticated users with Contributor-level access or above to read sensitive information from any database table within the WordPress installation.

As a result, sensitive data stored in the database could be exposed to unauthorized users, potentially leading to data leaks or privacy breaches.

Compliance Impact

This vulnerability allows authenticated attackers with Contributor-level access and above to extract sensitive data from arbitrary WordPress database tables. Such unauthorized exposure of sensitive information can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive data.

Because sensitive information can be exposed without proper authorization, organizations using the affected plugin may face risks related to data breaches, potentially violating regulatory requirements for data confidentiality and protection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4126. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart