CVE-2026-6922 Details
Description
The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions that causes the guard to never fire, combined with a permission callback that only verifies plugin role membership without per-post-type or ownership checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to trash or restore any post, page, or custom post type on the site by supplying arbitrary post IDs.
A vulnerability exists in the WP Table Builder plugin for WordPress, specifically in versions 2.1.1 through 2.1.13. The issue stems from an incorrect authorization flaw that allows authenticated users with subscriber-level access and above to delete or restore any post, page, or custom post type. This is made possible by an operator precedence bug in the post-type guard of the 'trash_table_bulk()' and 'restore_table_bulk()' functions, which prevents the guard from functioning correctly. Additionally, the permission callback only checks for plugin role membership without considering per-post-type or ownership requirements.
Users are advised to update the WP Table Builder plugin to version 2.1.14 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WP Table Builder | >= 2.1.1, <= 2.1.13 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 22, 2026 | New CVE Received | [email protected] |