CVE-2026-6922
Received Received - Intake

Incorrect Authorization in WP Table Builder WordPress Plugin

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Wordfence

Description
The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions that causes the guard to never fire, combined with a permission callback that only verifies plugin role membership without per-post-type or ownership checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to trash or restore any post, page, or custom post type on the site by supplying arbitrary post IDs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-6922
EUVD
EUVD-2026-84303

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_table_builder wp_table_builder to 2.2.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WP Table Builder WordPress plugin has an authorization flaw due to an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions. This bug prevents the guard from triggering, allowing authenticated users with subscriber-level access or higher to trash or restore any post, page, or custom post type by submitting arbitrary post IDs.

Detection Guidance

This vulnerability allows authenticated attackers with subscriber-level access to trash or restore any post, page, or custom post type. To detect it, check for unauthorized modifications to posts or pages, especially actions performed by low-privilege users. Review server logs for suspicious bulk actions or post ID manipulation.

Impact Analysis

An attacker could delete or restore any content on your WordPress site, including posts, pages, or custom post types, even if they only have basic subscriber access. This could lead to data loss, unauthorized content restoration, or disruption of site functionality.

Compliance Impact

This vulnerability could lead to unauthorized modification or deletion of sensitive data, violating integrity and access control requirements in GDPR and HIPAA. Unauthorized changes may result in non-compliance, potential data breaches, and legal consequences.

Mitigation Strategies

Update the WP Table Builder plugin to the latest version beyond 2.2.1 immediately to patch the authorization flaw. If an update is unavailable, consider disabling or removing the plugin until a fix is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6922. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart