WP Table Builder CVE-2026-6922

Exploitation requires the WP Table Builder - Drag & Drop Table Builder plugin version 2.2.1 or earlier to be installed and active, plus an authenticated account with subscriber-level access or above (PR:L) - so the practical prerequisite is that the site allows self-registration or the attacker otherwise holds a low-privilege account. Given those, no user interaction (UI:N) and no special configuration are needed: the attacker sends network requests to the trash_table_bulk()/restore_table_bulk() endpoints with arbitrary post IDs. The main limiting factor is the need for an authenticated foothold; sites that disable open registration substantially reduce exposure, and impact is bounded to trashing/restoring content (reversible) rather than data theft or code execution.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, base 7.1) tells a coherent story: network-reachable, low-complexity, requiring only low privileges (subscriber-level) and no user interaction, with the dominant impact being availability (A:H) plus limited integrity (I:L) and no confidentiality loss (C:N) - consistent with an attacker being able to trash or restore arbitrary posts, pages, and custom post types but not read or corrupt their contents. This is a genuine broken-authorization flaw (CWE-863) rooted in two compounding defects: an operator-precedence bug that neutralizes the post-type guard in trash_table_bulk()/restore_table_bulk(), and a permission callback that checks only plugin role membership without per-post-type or ownership verification. No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so exploitation probability cannot be quantified from the inputs; the honest status is that no public exploit was identified at time of analysis. The A:H rating is arguably generous because trashing is reversible (items go to trash, not permanent deletion, and can be restored), but an attacker can iteratively trash all site content - including the homepage and critical pages - producing a real denial-of-content condition, so a high availability weighting is defensible. Net: a moderately serious, low-barrier authorization bug on any site where untrusted users can obtain subscriber accounts, but not a critical RCE/data-breach class issue.

An attacker registers or obtains a subscriber-level account on a WordPress site running WP Table Builder <=2.2.1, then sends authenticated requests to the plugin's bulk trash/restore endpoints supplying arbitrary post IDs for any post, page, or custom post type. Because the post-type guard never fires and the permission check verifies only plugin role membership, the site's homepage, key pages, or WooCommerce products can be mass-trashed, disrupting the site until an administrator restores them. No public exploit code was identified at time of analysis, though the vulnerable source lines are directly referenced in the WordPress plugin trac.