EUVD-2026-24668
GHSA-2qxm-5chm-2w9c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Table Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0 via the 'table_manager' shortcode. The shortcode handler tablemanager_render_table_shortcode() takes a user-controlled table attribute, applies only sanitize_key() for sanitization, and concatenates the value with $wpdb->prefix to form a full database table name. It then executes DESC and SELECT * queries against this table and renders all rows and columns to the frontend. There is no allowlist check to ensure only plugin-created tables can be accessed - the tablemanager_created_tables option is only referenced in admin functions, never in the shortcode handler. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data from arbitrary WordPress database tables.
AnalysisAI
Table Manager plugin for WordPress versions up to 1.0.0 allows authenticated Contributor-level users and above to extract sensitive data from arbitrary WordPress database tables via the 'table_manager' shortcode. The vulnerability stems from insufficient input validation on the table name parameter-the plugin uses only sanitize_key() without an allowlist check, enabling attackers to enumerate and read data from any accessible database table by manipulating the shortcode attribute. No public exploit code has been identified, but the attack requires only valid WordPress credentials at Contributor level or higher.
Technical ContextAI
The vulnerability exists in the shortcode handler tablemanager_render_table_shortcode(), which processes user-supplied table names from the 'table' attribute of the [table_manager] shortcode. The plugin applies sanitize_key() to normalize the input, concatenates it with $wpdb->prefix to construct the full database table name, and then executes DESC and SELECT * queries without validation. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)-the plugin fails to implement an allowlist mechanism to restrict access to only its own created tables, despite storing a list of authorized tables in the tablemanager_created_tables option. This list is only checked in admin functions, not in the public-facing shortcode handler. WordPress core's sanitize_key() function is designed for normalization (converting to lowercase, removing special characters), not access control, making it unsuitable as a sole defense against table enumeration.
RemediationAI
Wordfence has documented this vulnerability and a patch is expected; however, no specific patched version number is confirmed in the provided data. Site administrators should immediately update the Table Manager plugin once a patched version is released by checking the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/25b3607c-f99e-4359-8228-0f3452f80aac and the official WordPress plugin repository. As an interim compensating control, site administrators without direct access to plugin code can restrict the 'table_manager' shortcode to administrator users only via a code snippet or by using a role-based shortcode restriction plugin, though this may break intended functionality for legitimate users. A more targeted workaround is to disable the shortcode entirely for non-admin users using a custom must-use plugin (in wp-content/mu-plugins/) that unregisters the shortcode or wraps it with a capability check for manage_options. The plugin author should implement an allowlist by cross-referencing the user-supplied table name against the tablemanager_created_tables option before executing queries. Site owners should review database access logs and audit which tables have been accessed via this shortcode if the plugin has been active with untrusted users.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today