CVE-2026-18881 in TableOn Plugin
Summary
by MITRE • 08/05/2026
The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the `filter_data[comment_count]` parameter of the public `tableon_get_table_data` AJAX action in all versions up to, and including, 1.0.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query — the value is split on `:` and both halves are interpolated directly into a `posts_where` SQL clause without `intval()` casting or `$wpdb->prepare()`. This makes it possible for unauthenticated attackers to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database (researcher demonstrated extraction of database(), wp_users.user_login, and wp_users.user_pass).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The TableOn WordPress plugin presents a critical blind sql injection vulnerability affecting versions up to 1051, exploiting the filter_datacomment_count parameter within the public tableon_get_table_data ajax endpoint. This flaw stems from inadequate input sanitization where user-supplied data undergoes no proper escaping or validation before being incorporated into database queries. The vulnerability manifests in the posts_where sql clause where the parameter value gets split on colons and both components are directly interpolated without proper type casting or query preparation mechanisms, creating an exploitable injection vector that bypasses standard security controls.
The technical implementation of this vulnerability follows a classic blind sql injection pattern where attackers can manipulate database queries through crafted input values. The filter_datacomment_count parameter accepts colon-separated values that are processed by splitting on the delimiter and then directly inserted into the sql query structure without any form of input validation or sanitization. This approach violates fundamental security principles and aligns with CWE-89 sql injection vulnerabilities, where insufficient input validation allows malicious sql code to be executed within the database context.
Operational impact of this vulnerability extends beyond simple data extraction as it provides attackers with complete database enumeration capabilities. The research demonstrated successful extraction of database name, wp_users user_login fields, and wp_users user_pass values, representing a severe compromise of system integrity. Attackers can leverage this vulnerability to perform blind sql injection techniques through time-based or boolean-based queries, potentially leading to full system compromise. The unauthenticated nature of this attack vector significantly amplifies the risk as any visitor to the wordpress site can exploit this weakness without requiring prior authentication credentials.
Mitigation strategies should focus on immediate patching of affected versions and implementation of proper input validation procedures. The recommended solution involves applying $wpdb->prepare() to all user-supplied parameters and implementing intval() casting for numeric values before database insertion. Additionally, organizations should enforce strict parameter validation and employ web application firewalls to detect and block suspicious sql injection patterns. This vulnerability demonstrates the importance of following secure coding practices as outlined in the OWASP top ten and aligns with ATT&CK technique T1071.004 application layer protocol encryption, where attackers exploit insecure data handling to gain unauthorized access to sensitive information systems.