Vulnerability alerts / September 22, 2026

Vulnerability in WP Table Builder – Drag & Drop Table Builder — CVE-2026-6922

HighSeverity
CVSS 7.1

0.6%Estimated exploit probability
EPSS

50,000+ sitesInstalls

2.1.14Fixed in

What to do now

Update WP Table Builder – Drag & Drop Table Builder to 2.1.14 or later.

Affected versions

Everything up to and including 2.2.1

Affected: WP Table Builder – Drag & Drop Table Builder (plugin, wp-table-builder)

Check: The plugin on wordpress.org / Our record for WP Table Builder – Drag & Drop Table Builder

What the vulnerability is

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions that causes the guard to never fire, combined with a permission callback that only verifies plugin role membership without per-post-type or ownership checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to trash or restore any post, page, or custom post type on the site by supplying arbitrary post IDs.

This description is reproduced verbatim from the public vulnerability record.

Sources

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.

See other alerts