CVE-2026-18881
Received Received - Intake

Blind SQL Injection in TableOn WordPress Posts Table Filterable Plugin

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Wordfence

Description
The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the `filter_data[comment_count]` parameter of the public `tableon_get_table_data` AJAX action in all versions up to, and including, 1.0.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query — the value is split on `:` and both halves are interpolated directly into a `posts_where` SQL clause without `intval()` casting or `$wpdb->prepare()`. This makes it possible for unauthenticated attackers to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database (researcher demonstrated extraction of database(), wp_users.user_login, and wp_users.user_pass).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-18881
EUVD
EUVD-2026-53181

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tableon wordpress_posts_table_filterable_plugin to 1.0.5.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a blind SQL injection vulnerability in the TableOn WordPress plugin. It allows unauthenticated attackers to inject malicious SQL code via the filter_data[comment_count] parameter. The plugin fails to properly escape user input and directly interpolates it into SQL queries, enabling attackers to extract sensitive data like database names and user credentials from the WordPress database.

Detection Guidance

This vulnerability can be detected by checking if the TableOn plugin is installed and its version is up to 1.0.5.1. Inspect network traffic for suspicious SQL-like queries targeting the `filter_data[comment_count]` parameter in the `tableon_get_table_data` AJAX action.

Impact Analysis

An attacker could exploit this to steal sensitive data such as database contents, WordPress admin credentials, or other confidential information stored in the database. Since it requires no authentication, any website using the vulnerable plugin version is at risk of data breaches or further compromise.

Compliance Impact

This vulnerability could lead to unauthorized access and exfiltration of personal data, violating GDPR and HIPAA requirements for data protection and security. Organizations may face legal penalties, fines, or reputational damage if exploited.

Mitigation Strategies

Immediately update the TableOn plugin to the latest version beyond 1.0.5.1. If an update is unavailable, disable the plugin until a patch is released. Monitor database queries for unusual activity and restrict unauthenticated access to AJAX endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18881. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart