Executive brief
The WP Table Builder WordPress plugin contains an authorization flaw that allows low-privileged users (subscribers and above) to delete or restore any posts, pages, or custom content on a WordPress site. Due to a logic error in permission checks, attackers can bypass the intended ownership and role restrictions by directly manipulating post IDs in requests. This could lead to data loss, website defacement, or disruption of business operations.
Technical details
An operator precedence bug in the trash_table_bulk() and restore_table_bulk() functions causes the post-type guard to never execute, combined with a permission callback that only checks plugin role membership without enforcing per-post ownership or type validation. An authenticated attacker with subscriber-level privileges or higher can supply arbitrary post IDs to trash or restore any post type on the site. This is a bypass of authorization controls with no special preconditions beyond authentication.
Affected products
- WP Table Builder WP Table Builder up to and including 2.2.1
Timeline
- 2026-09-22: disclosed