CVE-2026-4126
Sensitive Information Exposure in WordPress Table Manager Plugin
Publication date: 2026-04-22
Last updated on: 2026-04-22
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | table_manager | to 1.0.0 (inc) |
| table_manager | table_manager | to 1.0.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows authenticated attackers with Contributor-level access and above to extract sensitive data from arbitrary WordPress database tables. Such unauthorized exposure of sensitive information can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive data.
Because sensitive information can be exposed without proper authorization, organizations using the affected plugin may face risks related to data breaches, potentially violating regulatory requirements for data confidentiality and protection.
Can you explain this vulnerability to me?
The Table Manager plugin for WordPress has a vulnerability in its shortcode handler 'tablemanager_render_table_shortcode()'. This handler takes a user-controlled 'table' attribute and only applies minimal sanitization using 'sanitize_key()'. It then concatenates this value with the WordPress database prefix to form a table name and executes database queries (DESC and SELECT *) on that table.
Because there is no allowlist check to ensure that only plugin-created tables can be accessed, authenticated users with Contributor-level access or higher can exploit this to extract sensitive data from arbitrary WordPress database tables.
How can this vulnerability impact me? :
This vulnerability allows authenticated users with Contributor-level access or above to read sensitive information from any database table within the WordPress installation.
As a result, sensitive data stored in the database could be exposed to unauthorized users, potentially leading to data leaks or privacy breaches.