CVE-2026-6922: WP Table Builder Authorization Bypass Flaw

CVE-2026-6922 Overview

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress contains an incorrect authorization vulnerability [CWE-863] affecting all versions up to and including 2.2.1. The flaw resides in the trash_table_bulk() and restore_table_bulk() functions, where an operator precedence bug prevents the post-type guard from firing. The permission callback only verifies plugin role membership, without checking per-post-type ownership or capabilities. Authenticated attackers with subscriber-level access can trash or restore any post, page, or custom post type by supplying arbitrary post IDs.

Critical Impact
Any authenticated user at subscriber level or above can trash or restore arbitrary content site-wide, causing loss of availability for published pages, posts, and custom post types.

Affected Products

WP Table Builder – Drag & Drop Table Builder plugin for WordPress
All versions up to and including 2.2.1
WordPress sites permitting subscriber-level registration are at highest risk

Discovery Timeline

2026-09-22 - CVE CVE-2026-6922 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-6922

Vulnerability Analysis

The plugin exposes REST endpoints for bulk trash and restore operations on table posts. These endpoints are gated by a permission callback defined in inc/Admin/Authorization.php that only verifies membership in a plugin-defined role. The callback does not evaluate the WordPress capability associated with the target object, nor does it verify that the supplied post IDs belong to the plugin's custom post type.

Inside trash_table_bulk() and restore_table_bulk() at inc/Admin/Api/TablePost.php, a secondary guard attempts to reject IDs whose post type does not match the plugin's expected type. This guard is written with an operator precedence bug that causes the boolean expression to evaluate in a way that never triggers the rejection branch. As a result, every supplied ID is processed regardless of its post type.

Combined, these two flaws let a low-privileged authenticated user submit arbitrary post IDs and move core content into or out of the trash. The impact is loss of integrity and availability of site content without any confidentiality exposure.

Root Cause

The root cause is twofold. First, the permission callback conflates plugin role membership with authorization to act on arbitrary post objects. Second, the intended post-type validation inside the bulk handlers is neutralized by an operator precedence error in its conditional expression, so the safety check silently passes.

Attack Vector

An attacker registers or uses an existing subscriber account and issues authenticated requests to the plugin's bulk trash or restore endpoints, supplying IDs of pages, posts, WooCommerce products, or other custom post types. The endpoints accept the IDs and invoke wp_trash_post() or restore logic against them, silently taking site content offline or resurrecting previously trashed content.

See the WordPress Plugin TablePost source at line 292, line 299, and line 318, together with the Authorization callback at line 9, for the specific code paths involved.

Detection Methods for CVE-2026-6922

Indicators of Compromise

Unexpected post_status transitions to trash for posts, pages, or custom post types not owned by the plugin
WordPress REST API requests to WP Table Builder bulk endpoints originating from subscriber or contributor accounts
Spikes in wp_trash_post or restore actions correlated with low-privilege session activity
Audit log entries showing bulk state changes for post IDs that do not correspond to WP Table Builder tables

Detection Strategies

Monitor WordPress activity logs for bulk trash or restore actions performed by non-editor accounts
Alert on REST API calls from authenticated sessions targeting wp-table-builder bulk routes with post IDs outside the plugin's custom post type
Correlate new subscriber account registrations with subsequent bulk content-state changes

Monitoring Recommendations

Enable a WordPress audit logging plugin that records post status transitions with actor identity
Forward web server access logs and WordPress event logs to a centralized log platform for retention and alerting
Track the installed version of WP Table Builder across managed sites and flag any host still running 2.2.1 or earlier

How to Mitigate CVE-2026-6922

Immediate Actions Required

Update WP Table Builder to the patched release above version 2.2.1 on every WordPress site where the plugin is installed
Review the site trash bin and restore any legitimate content that was trashed by unauthorized users
Audit user accounts and remove or downgrade unknown subscriber-level accounts created shortly before the disclosure
Rotate credentials for any account observed exercising the affected endpoints

Patch Information

The vendor addressed the flaw in WordPress Plugin Changeset #3676426. Additional details are available in the Wordfence Vulnerability Report. Administrators should install the fixed release through the WordPress plugin updater and verify the reported version after upgrade.

Workarounds

Disable open user registration or restrict the default role so untrusted visitors cannot obtain subscriber accounts
Deactivate WP Table Builder until the patched version is installed if updates cannot be applied immediately
Use a web application firewall rule to block REST requests to the plugin's bulk trash and restore routes from non-administrator sessions
Restrict access to /wp-json/ endpoints for low-privileged roles at the reverse proxy layer

bash

# Example: block WP Table Builder bulk endpoints for non-admins at the edge (nginx)
location ~* /wp-json/wp-table-builder/.*/(trash|restore)_table_bulk {
    if ($http_x_wp_role !~* "administrator|editor") {
        return 403;
    }
}