CVE-2026-18881 Overview
CVE-2026-18881 is a blind SQL injection vulnerability in the TableOn – WordPress Posts Table Filterable plugin. The flaw affects all versions up to and including 1.0.5.1. Unauthenticated attackers can inject SQL statements through the filter_data[comment_count] parameter of the public tableon_get_table_data AJAX action. The plugin splits the parameter value on : and interpolates both halves directly into a posts_where SQL clause without intval() casting or $wpdb->prepare(). The Wordfence advisory notes that a researcher demonstrated extraction of database(), wp_users.user_login, and wp_users.user_pass values from affected sites.
Critical Impact
Unauthenticated attackers can extract WordPress administrator credentials and other sensitive database contents through crafted AJAX requests, enabling site takeover.
Affected Products
- TableOn – WordPress Posts Table Filterable plugin versions ≤ 1.0.5.1
- WordPress sites exposing the tableon_get_table_data AJAX action
- Fixed in TableOn version 1.0.6
Discovery Timeline
- 2026-08-05 - CVE-2026-18881 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-18881
Vulnerability Analysis
The vulnerability is a classic blind SQL injection [CWE-89] exposed through an unauthenticated WordPress AJAX endpoint. The tableon_get_table_data action processes a filter_data array supplied by the client. The comment_count element of that array is split on the colon character, and the resulting two substrings are concatenated directly into the SQL fragment appended to the posts_where filter used by WordPress WP_Query. Because the code performs neither integer casting via intval() nor parameter binding via $wpdb->prepare(), an attacker controls raw SQL that executes with the database user configured for WordPress. Blind exfiltration via boolean-based or time-based payloads allows retrieval of arbitrary tables, including the wp_users table.
Root Cause
The root cause is missing input validation and unsafe query construction. The affected code path in profiles/default/default.php (around line 765) concatenates user input into the WHERE clause instead of using WordPress prepared statements. The fix in the 1.0.6 changeset introduces sanitization and safe query composition.
Attack Vector
Exploitation is remote and unauthenticated. An attacker sends a POST request to /wp-admin/admin-ajax.php with action=tableon_get_table_data and a crafted filter_data[comment_count] value containing a colon-separated payload. The two halves are injected into the SQL query, allowing the attacker to append conditions or subqueries that reveal data through response differences or timing side channels.
// No verified public exploit code is available. See the Wordfence advisory
// and the WordPress plugin changeset for technical detail on the vulnerable
// parameter parsing and the applied fix.
Detection Methods for CVE-2026-18881
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php with action=tableon_get_table_data containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or information_schema inside filter_data[comment_count].
- Requests where the filter_data[comment_count] value contains a : separator followed by non-numeric characters.
- Unusual database response latency or bursts of failed AJAX calls originating from a single IP.
- Unexpected reads against the wp_users table correlated with plugin AJAX traffic.
Detection Strategies
- Inspect web server access logs for repeated tableon_get_table_data requests with encoded quotes, parentheses, or SQL keywords.
- Enable MySQL general or slow query logging and search for queries containing anomalous posts_where clauses referencing user_pass or information_schema.
- Deploy a Web Application Firewall (WAF) rule matching SQL syntax in the filter_data[comment_count] parameter.
Monitoring Recommendations
- Baseline normal request volume for the tableon_get_table_data endpoint and alert on deviations.
- Alert on any WordPress AJAX request whose parameters contain SQL metacharacters combined with a colon delimiter.
- Monitor for outbound data spikes from web servers that could indicate mass extraction of database contents.
How to Mitigate CVE-2026-18881
Immediate Actions Required
- Update the TableOn – WordPress Posts Table Filterable plugin to version 1.0.6 or later.
- Audit wp_users for unauthorized accounts and force password resets for administrators if exploitation is suspected.
- Rotate WordPress secret keys in wp-config.php and invalidate active sessions after patching.
- Review web and database logs for prior exploitation attempts against tableon_get_table_data.
Patch Information
The vendor addressed the issue in TableOn version 1.0.6. The fix is documented in the WordPress Plugin Changeset and analyzed in the Wordfence Vulnerability Analysis. Site owners should apply the update through the WordPress plugin manager or via WP-CLI.
Workarounds
- If the plugin cannot be updated immediately, deactivate and delete it until the patched version is installed.
- Block requests to /wp-admin/admin-ajax.php where the action parameter equals tableon_get_table_data at the WAF or reverse proxy layer.
- Restrict outbound network access from the web server to limit data exfiltration if injection succeeds.
# Example WP-CLI upgrade command
wp plugin update posts-table-filterable --version=1.0.6
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
