Wp Table Builder Drag Drop Table Builder
Monthly
Authenticated attackers with subscriber-level access or above can trash or restore any post, page, or custom post type on WordPress sites running the WP Table Builder - Drag & Drop Table Builder plugin in versions up to and including 2.2.1. The vulnerability arises from a broken authorization check in the plugin's trash_table_bulk() and restore_table_bulk() functions, where an operator precedence bug prevents the intended post-type guard from executing and the permission callback only verifies plugin role membership without per-post-type or ownership checks. With a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H), exploitation requires an authenticated foothold but no user interaction, resulting in high availability impact and limited integrity impact with no confidentiality loss; no public exploit identified at time of analysis.
Authenticated attackers with subscriber-level access or above can trash or restore any post, page, or custom post type on WordPress sites running the WP Table Builder - Drag & Drop Table Builder plugin in versions up to and including 2.2.1. The vulnerability arises from a broken authorization check in the plugin's trash_table_bulk() and restore_table_bulk() functions, where an operator precedence bug prevents the intended post-type guard from executing and the permission callback only verifies plugin role membership without per-post-type or ownership checks. With a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H), exploitation requires an authenticated foothold but no user interaction, resulting in high availability impact and limited integrity impact with no confidentiality loss; no public exploit identified at time of analysis.