CVE-2026-74006 in Table Builder Plugin
Summary
by MITRE • 08/18/2026
Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified as Contributor Broken Access Control in WP Table Builder prior to version 2.2.0 represents a critical flaw in the plugin's authorization logic, specifically targeting users assigned the WordPress contributor role. In standard WordPress environments, contributors are permitted to create and edit their own posts but lack the ability to publish them or access administrative features without explicit elevation by an administrator. However, due to insufficient server-side validation within WP Table Builder, this restriction was bypassed, allowing these lower-privilege users to perform actions that should be reserved for higher-level roles such as authors, editors, or administrators. This type of flaw is a classic example of insecure direct object references and broken access control mechanisms where the application fails to enforce proper policy regarding which objects a user can access based on their identity and privileges.
From a technical perspective, the root cause lies in the failure to verify that the authenticated user possesses the necessary capabilities before processing requests related to table creation, modification, or deletion. When a contributor interacts with the plugin's interface, the backend does not adequately check if the current session holds permissions beyond those granted by default for contributors. Consequently, an attacker exploiting this vulnerability can manipulate HTTP requests to create new tables, modify existing ones containing sensitive data, or delete critical configuration entries that affect other users on the same WordPress installation. This lack of proper authorization checks enables unauthorized state changes and potential data manipulation, undermining the integrity of the web application's content management system.
The operational impact of this vulnerability is significant for any organization relying on WP Table Builder to manage structured data within their WordPress site. An authenticated contributor can escalate their effective privileges by creating malicious tables that may contain phishing links, malware payloads, or scripts designed to steal session cookies from other users through cross-site scripting vectors embedded in table content. Furthermore, the ability to delete existing tables could lead to denial of service conditions for legitimate business operations dependent on those data structures. In multi-user environments where contributors are trusted with basic content creation but not administrative oversight, this flaw effectively neutralizes that trust boundary, allowing a single compromised or malicious contributor account to disrupt services and compromise other users' data integrity across the platform.
This vulnerability aligns closely with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, which describe scenarios where an actor is able to perform actions without having been granted explicit permission. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior corresponds to T1078 Valid Accounts, specifically the sub-technique of using default accounts or exploiting misconfigured permissions to gain initial access and lateral movement within a system. The exploitation does not require complex injection techniques but rather relies on social engineering or credential theft followed by simple request manipulation against unprotected endpoints exposed by the plugin's API or form handlers.
To mitigate this risk, organizations running WP Table Builder versions 2.1.0 through 2.2.0 must immediately update to version 2.2.0 or later where these authorization checks have been corrected and enforced at the server level. Until an upgrade is feasible, administrators should consider restricting contributor access entirely if the plugin is not strictly necessary for their workflow, or alternatively, elevate trusted contributors to author status only after verifying they do not require administrative capabilities that could be abused via this specific vector. Regular auditing of user roles and permissions within WordPress installations is essential to ensure that privilege boundaries are maintained according to the principle of least privilege. Additionally, implementing Web Application Firewalls with rules targeting known exploitation patterns for broken access control can provide an additional layer of defense against automated attacks attempting to leverage these misconfigurations.