TableOn WordPress Plugin CVE-2026-18881

The TableOn - WordPress Posts Table Filterable plugin must be installed and active on the WordPress site in any version up to and including 1.0.5.1. The AJAX action tableon_get_table_data is registered as a public hook using WordPress's wp_ajax_nopriv_ prefix, making it available to unauthenticated (not-logged-in) users with no authentication token, nonce bypass, or privilege escalation required. Exploitation requires only HTTP access to the wp-admin/admin-ajax.php endpoint with a POST body supplying the action and filter_data[comment_count] parameters - this is a standard WordPress request format. No non-default WordPress configuration, special server settings, or plugin-specific options are required; any default installation of the affected plugin versions on a network-accessible WordPress site is exploitable. What limits exploitation: the attacker cannot write data (no INSERT/UPDATE/DELETE capability is indicated) and the scope does not extend beyond the WordPress database. The injection is blind (no direct error output), which requires time-based or boolean-based enumeration and increases attack duration compared to error-based injection.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) accurately captures the real-world threat posture: network-accessible, zero authentication, low complexity, and high confidentiality impact with no integrity or availability dimension. The public AJAX registration is confirmed in the source code, so the unauthenticated attack surface is not conditional. The target data - WordPress user_login and user_pass (MD5-hashed passwords) - is high-value: successful extraction directly enables offline password cracking and subsequent account takeover. No EPSS data was provided and this CVE is not listed in CISA KEV, meaning active exploitation has not been confirmed by a government authority. However, the detailed public disclosure from Wordfence and the low exploitation complexity substantially lower the barrier for independent exploit development. The confidentiality impact is genuine and the remediation path (plugin update) is clear, making this a real patching priority for any WordPress deployment running the affected plugin.

An unauthenticated attacker sends a crafted HTTP POST request to the target WordPress site's wp-admin/admin-ajax.php endpoint with action=tableon_get_table_data and a filter_data[comment_count] value such as 1:(SELECT SLEEP(5)) to confirm time-based blind injection. Once confirmed, the attacker iterates boolean-based payloads to extract wp_users.user_login and wp_users.user_pass character by character, then subjects the recovered MD5-hashed passwords to offline dictionary or brute-force attacks to obtain plaintext credentials and gain WordPress admin access.