What is the CVSS score of CVE-2026-4126?

CVE-2026-4126 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Table Manager CVE-2026-4126

EUVD-2026-24668 MEDIUM

Information Exposure (CWE-200)

2026-04-22 Wordfence

GHSA-2qxm-5chm-2w9c

Information Disclosure WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:00 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24668

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 4.3

DescriptionCVE.org

The Table Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0 via the 'table_manager' shortcode. The shortcode handler tablemanager_render_table_shortcode() takes a user-controlled table attribute, applies only sanitize_key() for sanitization, and concatenates the value with $wpdb->prefix to form a full database table name. It then executes DESC and SELECT * queries against this table and renders all rows and columns to the frontend. There is no allowlist check to ensure only plugin-created tables can be accessed - the tablemanager_created_tables option is only referenced in admin functions, never in the shortcode handler. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data from arbitrary WordPress database tables.

AnalysisAI

Table Manager plugin for WordPress versions up to 1.0.0 allows authenticated Contributor-level users and above to extract sensitive data from arbitrary WordPress database tables via the 'table_manager' shortcode. The vulnerability stems from insufficient input validation on the table name parameter-the plugin uses only sanitize_key() without an allowlist check, enabling attackers to enumerate and read data from any accessible database table by manipulating the shortcode attribute. No public exploit code has been identified, but the attack requires only valid WordPress credentials at Contributor level or higher.

Technical ContextAI

The vulnerability exists in the shortcode handler tablemanager_render_table_shortcode(), which processes user-supplied table names from the 'table' attribute of the [table_manager] shortcode. The plugin applies sanitize_key() to normalize the input, concatenates it with $wpdb->prefix to construct the full database table name, and then executes DESC and SELECT * queries without validation. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)-the plugin fails to implement an allowlist mechanism to restrict access to only its own created tables, despite storing a list of authorized tables in the tablemanager_created_tables option. This list is only checked in admin functions, not in the public-facing shortcode handler. WordPress core's sanitize_key() function is designed for normalization (converting to lowercase, removing special characters), not access control, making it unsuitable as a sole defense against table enumeration.

RemediationAI

Wordfence has documented this vulnerability and a patch is expected; however, no specific patched version number is confirmed in the provided data. Site administrators should immediately update the Table Manager plugin once a patched version is released by checking the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/25b3607c-f99e-4359-8228-0f3452f80aac and the official WordPress plugin repository. As an interim compensating control, site administrators without direct access to plugin code can restrict the 'table_manager' shortcode to administrator users only via a code snippet or by using a role-based shortcode restriction plugin, though this may break intended functionality for legitimate users. A more targeted workaround is to disable the shortcode entirely for non-admin users using a custom must-use plugin (in wp-content/mu-plugins/) that unregisters the shortcode or wraps it with a capability check for manage_options. The plugin author should implement an allowlist by cross-referencing the user-supplied table name against the tablemanager_created_tables option before executing queries. Site owners should review database access logs and audit which tables have been accessed via this shortcode if the plugin has been active with untrusted users.