Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-6922

WP Table Builder – Drag & Drop Table Builder · Vulnerability

CVSS 3.1 7.1 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-6922

Published

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions that causes the guard to never fire, combined with a permission callback that only verifies plugin role membership without per-post-type or ownership checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to trash or restore any post, page, or custom post type on the site by supplying arbitrary post IDs.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-6922

Published

WP Table Builder – Drag & Drop Table Builder

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "wptb",
                    "product": "WP Table Builder – Drag & Drop Table Builder",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThanOrEqual": "2.2.1",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON