CVE-2026-74006: WP Table Builder Auth Bypass Vulnerability

CVE-2026-74006 Overview

CVE-2026-74006 is a broken access control vulnerability in the WP Table Builder WordPress plugin affecting versions up to and including 2.2.0. The flaw allows authenticated users with Contributor-level privileges to perform actions that should be restricted to higher-privileged roles. The weakness maps to CWE-862: Missing Authorization and stems from missing capability checks on plugin endpoints.

Critical Impact
Authenticated Contributor accounts can bypass authorization controls to modify plugin-managed data, resulting in unauthorized integrity changes to WordPress sites running the affected plugin.

Affected Products

WP Table Builder WordPress plugin versions <= 2.2.0
WordPress sites permitting Contributor-level user registration
Multi-author WordPress deployments using WP Table Builder

Discovery Timeline

2026-08-18 - CVE-2026-74006 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-74006

Vulnerability Analysis

The vulnerability resides in the WP Table Builder plugin's request handlers, which fail to verify the acting user's capabilities before executing privileged operations. WordPress delegates access control enforcement to plugin authors through the current_user_can() API. When a plugin omits these checks, any authenticated user session can invoke restricted actions.

Exploitation requires an authenticated account. The attack proceeds over the network against the WordPress admin-ajax.php or REST endpoints exposed by the plugin. Impact is limited to integrity — attackers cannot directly extract confidential data or disrupt availability through this flaw alone.

Root Cause

The root cause is a missing authorization check on plugin action handlers. The plugin validates nonces or authentication state but does not enforce a minimum role or capability requirement. Contributors, who are intended to draft content but not publish or manage site assets, retain sufficient session context to reach the vulnerable handlers.

Attack Vector

An attacker with Contributor credentials sends a crafted HTTP request to the plugin endpoint. Because the handler skips the capability check, the request executes with the attacker's session. The vector requires low privileges, no user interaction, and low attack complexity. See the Patchstack advisory for endpoint-level technical details.

Detection Methods for CVE-2026-74006

Indicators of Compromise

Unexpected creations, edits, or deletions of WP Table Builder tables performed by Contributor accounts
HTTP POST requests to plugin AJAX or REST endpoints originating from low-privileged user sessions
Modified table entries in the wp_posts table with post_type values managed by WP Table Builder and authored by Contributor users

Detection Strategies

Audit WordPress activity logs for plugin action calls performed by Contributor-role accounts
Correlate authenticated request patterns against expected role behavior for each user
Review plugin data changes and compare authoring user capabilities against the operations performed

Monitoring Recommendations

Enable a WordPress audit-logging plugin to record plugin API calls and privilege context
Alert on any Contributor-authored request reaching plugin-management endpoints
Monitor for spikes in admin-ajax.php requests referencing WP Table Builder actions from non-Editor accounts

How to Mitigate CVE-2026-74006

Immediate Actions Required

Update WP Table Builder to a version later than 2.2.0 once the vendor releases a patched build
Review and reduce the number of Contributor-role accounts on affected WordPress installations
Rotate credentials for Contributor accounts if unauthorized plugin activity is observed

Patch Information

At the time of NVD publication, the affected version is WP Table Builder <= 2.2.0. Site owners should consult the Patchstack advisory and the WordPress plugin repository for the fixed release. Apply updates through the WordPress admin dashboard or via wp-cli once available.

Workarounds

Temporarily deactivate WP Table Builder on sites that permit untrusted Contributor registrations
Restrict access to wp-admin/admin-ajax.php and plugin REST routes via a web application firewall rule
Disable open user registration or require manual approval before assigning the Contributor role

bash

# Update WP Table Builder via wp-cli once a fixed version is released
wp plugin update wp-table-builder

# List current Contributor accounts for review
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered

# Deactivate the plugin as a temporary workaround
wp plugin deactivate wp-table-builder