CVE-2026-66659: Tablesome Table SQL Injection Vulnerability

CVE-2026-66659 Overview

CVE-2026-66659 is a blind SQL injection vulnerability in the Essekia Tablesome Table WordPress plugin. The flaw affects all versions up to and including 1.2.9. It stems from improper neutralization of special elements used in an SQL command [CWE-89].

Unauthenticated attackers can send crafted requests over the network to inject SQL statements into backend database queries. Successful exploitation exposes confidential database contents and can affect adjacent components because of a scope change. The vulnerability requires no authentication and no user interaction, making it trivial to weaponize against exposed WordPress sites.

Critical Impact
Unauthenticated attackers can extract sensitive data from the WordPress database through blind SQL injection, with a scope change amplifying impact beyond the vulnerable plugin.

Affected Products

Essekia Tablesome Table WordPress plugin versions up to and including 1.2.9
WordPress installations with the vulnerable plugin activated
Sites relying on plugin versions with no available patch identifier at time of publication

Discovery Timeline

2026-08-12 - CVE-2026-66659 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-66659

Vulnerability Analysis

The Tablesome Table plugin fails to sanitize user-supplied input before incorporating it into SQL queries. This omission enables blind SQL injection, where attackers infer database contents through conditional responses or time-based inference rather than direct data return.

The vulnerability is exploitable over the network without privileges or user interaction. Because the CVSS vector reports a scope change, the injected SQL can influence resources managed by a security authority beyond the plugin itself. Confidentiality impact is high, and availability impact is low, indicating the primary risk is data exfiltration.

According to the Patchstack advisory, the issue affects Tablesome Table from unspecified initial versions through 1.2.9.

Root Cause

The root cause is improper neutralization of special SQL characters in user input [CWE-89]. The plugin concatenates untrusted parameters into SQL queries without using prepared statements or parameterized queries. Standard WordPress database abstraction functions such as $wpdb->prepare() are either absent or incorrectly applied in the vulnerable code path.

Attack Vector

Attackers craft HTTP requests containing SQL payloads targeting plugin endpoints that process query parameters or POST data. Blind injection techniques include boolean-based inference and time-based payloads using functions such as SLEEP() or BENCHMARK(). Attackers iterate through payloads to extract data one bit or character at a time, eventually reconstructing credentials, session tokens, or personally identifiable information from WordPress tables such as wp_users and wp_usermeta.

No verified public proof-of-concept code is available for this vulnerability at the time of writing. Refer to the Patchstack database entry for coordinated disclosure details.

Detection Methods for CVE-2026-66659

Indicators of Compromise

HTTP requests to Tablesome plugin endpoints containing SQL syntax such as UNION, SELECT, SLEEP(, BENCHMARK(, or encoded variants
Unusually long response times on plugin endpoints indicating time-based blind injection probing
Repeated requests from a single source iterating over parameter values with incremental changes
Web server logs showing sequences of requests with SQL metacharacters such as ', --, ;, or /*

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query strings and POST bodies for SQL injection signatures targeting /wp-content/plugins/tablesome/ paths
Enable WordPress database query logging to identify malformed or unexpected queries originating from the plugin
Correlate HTTP access logs with database error logs to surface injection attempts that trigger syntax errors

Monitoring Recommendations

Monitor outbound traffic from the web server for unusual data volumes that could indicate database exfiltration
Alert on repeated 500-series responses from plugin endpoints, which often accompany injection probing
Track authentication anomalies on WordPress admin accounts, since extracted credentials may be reused for follow-on access

How to Mitigate CVE-2026-66659

Immediate Actions Required

Deactivate the Tablesome Table plugin until a patched version is confirmed available
Restrict access to WordPress admin and plugin endpoints using IP allowlists where feasible
Rotate WordPress administrator passwords and API keys if the plugin was exposed to untrusted networks
Review database audit logs for evidence of data exfiltration prior to remediation

Patch Information

No fixed version is identified in the NVD entry at the time of publication. The advisory indicates the vulnerability affects Tablesome Table through version 1.2.9. Consult the Patchstack advisory and the vendor for updated release information before re-enabling the plugin.

Workarounds

Deploy virtual patching through a WAF with rules blocking SQL injection payloads directed at Tablesome endpoints
Enforce least-privilege database credentials for the WordPress user to limit the scope of extractable data
Place the WordPress site behind an authentication proxy for administrative interfaces to reduce unauthenticated exposure

bash

# Configuration example: ModSecurity rule to block SQL injection attempts on Tablesome endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/tablesome/" \
    "id:1026066659,\
    phase:2,\
    t:none,t:urlDecodeUni,t:lowercase,\
    chain,\
    deny,status:403,\
    msg:'CVE-2026-66659 Tablesome SQL Injection Attempt'"
    SecRule ARGS "@rx (?i)(union\s+select|sleep\s*\(|benchmark\s*\(|'\s*or\s*'1'\s*=\s*'1|--\s|/\*)"