Description

Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-18T15:17:09.170Z",
  "pubdate": "2026-08-18T15:17:09.170Z",
  "executiveSummary": "This security analysis evaluates a Broken Access Control vulnerability affecting the WP Table Builder plugin, specifically impacting all versions up to and including version 2.2.0. Broken Access Control vulnerabilities occur when restrictions on what authenticated users are allowed to do are not properly enforced, allowing malicious actors to bypass authorization checks and access functionality or data outside of their intended permissions.\nThe primary impact of this vulnerability involves unauthorized contributors or lower-privileged users gaining the ability to perform administrative or high-privilege actions within the context of the WordPress site. This introduces severe risk implications, including potential data manipulation, unauthorized modification of site content, and broader compromise of site integrity.\nTo successfully exploit this vulnerability, an attacker typically requires a registered user account on the target WordPress installation with contributor-level privileges. The exploitation process does not inherently demand advanced attack capabilities beyond standard HTTP request manipulation, leveraging missing capability checks within the vulnerable component's endpoint handlers.\nOrganizations utilizing the affected product must prioritize remediation to neutralize the risk of unauthorized privilege escalation and maintain strict access boundaries across user roles.",
  "technicalDetails": "The root cause of this vulnerability lies in inadequate authorization checks and missing capability validations within the access control logic of WP Table Builder <= 2.2.0. When handling requests destined for specific plugin endpoints or administrative functions, the application fails to adequately verify whether the initiating user possesses the requisite administrative capabilities, such as manage_options or edit_others_posts, before executing sensitive operations.\nThe vulnerable component comprises the request handling routines and backend AJAX or REST API endpoints implemented by the WP Table Builder plugin. These endpoints process requests originating from users authenticated with lower-level privileges, specifically the contributor role. Because the codebase lacks rigorous authorization enforcement, an attacker authenticated as a contributor can invoke these backend functions directly by crafting custom HTTP requests targeting the exposed handlers.\nThe attack flow proceeds as follows: First, the attacker authenticates to the target WordPress platform using valid contributor-level credentials. Second, the attacker formulates an HTTP request targeted at the vulnerable WP Table Builder functionality, which is normally restricted to administrators or editors. Third, due to the absence of proper nonce verification and capability checks in the vulnerable component, the application processes the request and executes the requested action on behalf of the attacker.\nPrivilege requirements are limited to a standard user account with contributor privileges. Network exposure is inherent to any web-accessible WordPress deployment utilizing the affected plugin, exposing the vulnerable endpoints over standard HTTP/HTTPS protocols. Payload behavior during exploitation involves invoking unauthorized actions that bypass intended access boundaries. Post-exploitation impact encompasses unauthorized data modification, potential content injection, and degradation of the overall security posture of the WordPress application."
}