What is the CVSS score of CVE-2026-18881?

CVE-2026-18881 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of TableOn WordPress Plugin are affected by CVE-2026-18881?

The TableOn WordPress plugin (versions ≤1.0.5.1) contains a high-severity SQL injection vulnerability enabling unauthenticated attackers to extract WordPress user credentials and access sensitive…

How to fix or mitigate CVE-2026-18881?

Within 24 hours, identify WordPress installations running TableOn plugin versions 1.0.5.1 or earlier and disable the plugin or implement WAF rules to block the vulnerable AJAX endpoint. Within 7 days, upgrade all affected installations to TableOn version 1.0.6. Within 30 days, require password resets for all WordPress user accounts and audit access logs for evidence of unauthorized database queries during the exposure window.

TableOn WordPress Plugin CVE-2026-18881

EUVD-2026-53181 HIGH

SQL Injection (CWE-89)

2026-08-05 Wordfence

GHSA-m5hr-2pjq-pp4w

WordPress SQLi Tableon Wordpress Posts Table Filterable Wordpress Plugin Realmag777

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Public unauthenticated AJAX endpoint (PR:N, AV:N), trivially exploitable (AC:L), credential exfiltration only with no write or availability impact (C:H/I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 07:49 vuln.today

CVE Published

Aug 05, 2026 - 06:37 cve.org

HIGH 7.5

DescriptionCVE.org

The TableOn - WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the filter_data[comment_count] parameter of the public tableon_get_table_data AJAX action in all versions up to, and including, 1.0.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query - the value is split on : and both halves are interpolated directly into a posts_where SQL clause without intval() casting or $wpdb->prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database (researcher demonstrated extraction of database(), wp_users.user_login, and wp_users.user_pass).

AnalysisAI

Blind SQL injection in the TableOn - WordPress Posts Table Filterable plugin (versions ≤ 1.0.5.1) exposes WordPress user credentials to unauthenticated remote attackers via a public AJAX endpoint. The filter_data[comment_count] parameter is split on a colon delimiter and both halves are interpolated directly into a posts_where SQL clause without intval() casting or $wpdb->prepare() sanitization, enabling blind query appending. A researcher confirmed extraction of database metadata, all WordPress usernames, and password hashes; the fix is available in version 1.0.6, and no public exploit code has been identified at time of analysis.

Technical ContextAI

The affected code resides in the WordPress plugin TableOn - WordPress Posts Table Filterable by vendor realmag777 (CPE: cpe:2.3:a:realmag777:tableon_-_wordpress_posts_table_filterable:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The public AJAX action tableon_get_table_data is registered without authentication requirements, making it accessible to unauthenticated visitors through WordPress's wp-admin/admin-ajax.php dispatcher. Within this action handler, profiles/default/default.php (line 765) accepts the filter_data[comment_count] POST parameter, splits it on a : character, and directly concatenates both substrings into a WordPress posts_where filter clause - bypassing the standard protections of $wpdb->prepare() and integer casting via intval(). This allows an attacker to append arbitrary SQL logic to the existing query, enabling boolean-based or time-based blind data extraction.

RemediationAI

Update the TableOn - WordPress Posts Table Filterable plugin to version 1.0.6 or later immediately; the fix applies proper SQL sanitization in profiles/default/default.php and is confirmed in the WordPress Plugin Repository changeset at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3520311%40posts-table-filterable%2Ftrunk&new=3520313%40posts-table-filterable%2Ftrunk. If an immediate upgrade is not feasible, a web application firewall rule that blocks or sanitizes POST requests to wp-admin/admin-ajax.php containing action=tableon_get_table_data combined with a filter_data[comment_count] value containing colon characters can serve as a temporary compensating control, though this will break the plugin's comment-count filtering functionality. Alternatively, restricting all tableon_get_table_data AJAX requests to authenticated WordPress users at the firewall or reverse-proxy layer eliminates the unauthenticated attack vector entirely until the patch is applied, with the trade-off that unauthenticated table-filtering features will cease to function.