Description

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions that causes the guard to never fire, combined with a permission callback that only verifies plugin role membership without per-post-type or ownership checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to trash or restore any post, page, or custom post type on the site by supplying arbitrary post IDs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-22T08:16:39.990Z",
  "pubdate": "2026-09-22T08:16:39.990Z",
  "executiveSummary": "The WP Table Builder plugin for WordPress, in versions up to and including 2.2.1, suffers from an Incorrect Authorization vulnerability. This security flaw stems from flawed logical checks within the plugin's administrative bulk action functions, specifically trash_table_bulk() and restore_table_bulk().\nThe vulnerability allows authenticated users with subscriber-level privileges or higher to perform unauthorized administrative actions on arbitrary content across the WordPress installation. By manipulating parameters, an attacker can transition arbitrary posts, pages, or custom post types to the trash or restore them from the trash, regardless of whether the user possesses the necessary administrative capabilities or ownership of the target content.\nThis represents a significant privilege escalation and integrity risk. Because the plugin fails to enforce proper per-post-type validation and ownership verification, the security impact is severe, potentially leading to unauthorized data destruction or content restoration. This exposure affects any site utilizing the vulnerable version of the plugin, regardless of the attacker's low-level account status.",
  "technicalDetails": "The root cause of this vulnerability is a combination of flawed operator precedence in the post-type guard logic and insufficient authorization checks within the trash_table_bulk() and restore_table_bulk() functions. In the affected versions, the logic designed to ensure that the bulk action is only applied to specific table types fails to execute correctly because the PHP operator precedence causes the condition to evaluate in a way that effectively disables the guard.\nFurthermore, the permission callback associated with these functions only validates if the requesting user possesses basic plugin role membership. It fails to perform granular checks, such as verifying if the user has 'edit_post' or 'manage_options' capabilities, and does not conduct any ownership checks or post-type validation. Consequently, the functions accept arbitrary post IDs passed via the request without verifying if the user is authorized to perform state-changing operations on the targeted entities.\nThe attack flow proceeds as follows: An authenticated attacker with subscriber access constructs a malicious HTTP request targeting the plugin's bulk action handler. By injecting arbitrary IDs (e.g., standard post IDs, page IDs, or other custom post type IDs) into the bulk action parameter, the attacker bypasses the intended scope of the plugin. The plugin, failing to validate these IDs against the legitimate table-builder post types due to the faulty guard, proceeds to execute the requested trash or restore operation on the provided IDs.\nBecause WordPress core functions like wp_trash_post() and wp_untrash_post() are subsequently invoked, the plugin successfully modifies the database state of the victim's site content. This occurs entirely server-side, requiring no specific network exposure other than access to the WordPress administrative backend, which is standard for authenticated users. The post-exploitation impact includes the ability to perform a Denial of Service (DoS) by trashing essential site content or manipulating content visibility by restoring items that were intentionally trashed by administrators. The lack of validation creates a direct vector for unauthorized content management modification."
}