CVE-2026-14924 Overview
CVE-2026-14924 is a missing authorization vulnerability in the Tablesome Table WordPress plugin before version 1.1.31. The plugin registers an AJAX action that omits authentication, capability, and nonce checks. Unauthenticated attackers can invoke this action over the network to create new published posts and overwrite arbitrary existing posts and pages. The flaw is classified as [CWE-862] Missing Authorization and affects content integrity on any WordPress site running a vulnerable Tablesome release.
Critical Impact
Unauthenticated remote attackers can publish new posts and overwrite existing WordPress posts and pages, enabling defacement, SEO poisoning, and malicious content injection.
Affected Products
- Tablesome Table WordPress plugin versions prior to 1.1.31
- WordPress sites with the vulnerable plugin activated
- Any hosting environment exposing wp-admin/admin-ajax.php to the public internet
Discovery Timeline
- 2026-07-28 - CVE-2026-14924 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-14924
Vulnerability Analysis
The Tablesome Table plugin exposes an AJAX endpoint through the WordPress admin-ajax.php handler. WordPress dispatches AJAX actions to registered handlers based on the action parameter, and plugins are responsible for enforcing their own authorization. The affected handler in Tablesome performs no checks before writing to the posts table. It does not call is_user_logged_in(), does not verify a capability with current_user_cap(), and does not validate a nonce via check_ajax_referer(). Any anonymous HTTP client can therefore reach the handler and instruct it to create or modify posts.
The practical result is unauthenticated write access to the WordPress content store. Attackers can publish new posts marked as publish, and they can supply an existing post or page ID to overwrite its title, content, or status. Overwriting the site's homepage, privacy policy, or a high-traffic article enables defacement, malware delivery through injected scripts, and search engine ranking abuse. The vulnerability affects integrity only; confidentiality and availability are not directly impacted.
Root Cause
The root cause is the omission of three standard WordPress authorization primitives in a single AJAX handler: session verification, capability checks, and nonce validation. The handler is registered under both wp_ajax_ and wp_ajax_nopriv_ hooks, or its logic path does not distinguish between authenticated and anonymous callers.
Attack Vector
Exploitation requires only a single unauthenticated HTTP POST request to admin-ajax.php with the vulnerable action name and post payload. No user interaction and no prior access are required. The vulnerability mechanism is described in the WPScan Vulnerability Report; no verified proof-of-concept code has been published.
Detection Methods for CVE-2026-14924
Indicators of Compromise
- Unexpected POST requests to /wp-admin/admin-ajax.php from unauthenticated sources referencing Tablesome AJAX actions
- New published posts authored by user ID 0 or with no associated author account
- Modifications to existing posts or pages with no corresponding entry in the WordPress audit log or user activity log
- Sudden appearance of external links, redirect scripts, or spam content in previously trusted posts
Detection Strategies
- Review web server access logs for POST requests to admin-ajax.php where the action parameter matches Tablesome handlers and the request lacks an authenticated session cookie
- Compare current post content against known-good backups to identify unauthorized modifications
- Query the wp_posts table for post_modified timestamps that do not align with legitimate editorial activity
Monitoring Recommendations
- Enable file integrity and database change monitoring for the WordPress wp_posts table
- Forward WordPress and web server logs to a central analytics platform for correlation across sites
- Alert on high volumes of anonymous POST requests to admin-ajax.php targeting a single action name
How to Mitigate CVE-2026-14924
Immediate Actions Required
- Update the Tablesome Table plugin to version 1.1.31 or later on every WordPress installation
- Audit the wp_posts table for unauthorized post creation and content modification since the plugin was installed
- Rotate credentials and review administrator accounts if unauthorized post activity is confirmed
- Restore affected posts and pages from a clean backup taken before the compromise window
Patch Information
The vendor addressed the missing authorization checks in Tablesome Table 1.1.31. Administrators should apply the update through the WordPress plugin manager or WP-CLI. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate and remove the Tablesome Table plugin until the site can be updated to 1.1.31
- Restrict access to wp-admin/admin-ajax.php from untrusted networks using a web application firewall rule
- Block anonymous POST requests to admin-ajax.php that target Tablesome action names at the reverse proxy
# Update the Tablesome plugin using WP-CLI
wp plugin update tablesome --version=1.1.31
# Verify installed version across a multisite network
wp plugin list --name=tablesome --fields=name,status,version
# Temporary mitigation: deactivate the plugin until patched
wp plugin deactivate tablesome
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
