CVE-2026-110016: Data Tables Generator by Supsystic < 1.15.8 - Unauthenticated Table Content Disclosure via IDOR
The Data Tables Generator by Supsystic WordPress plugin before 1.15.8 does not perform any authorization or ownership check before returning the stored contents of a table, relying only on a nonce that is exposed to every anonymous visitor, allowing unauthenticated users to read the full contents of any table by its identifier, including tables that are never published anywhere on the site.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated visitor can exploit it because the required nonce is exposed to anonymous users and the affected plugin does not verify authorization or table ownership.
What information could be exposed?
An attacker can read the complete stored contents of tables by supplying their identifiers. This includes tables that have not been published anywhere on the site.
What versions are affected?
Versions of Data Tables Generator by Supsystic before 1.15.8 are affected. Updating to version 1.15.8 or later addresses the affected version range.
How can I determine whether my site is exposed?
Check whether the Data Tables Generator by Supsystic plugin is installed and its version is earlier than 1.15.8. Sites with stored tables should treat both published and unpublished table content as potentially accessible to anonymous visitors until updated.