CVE-2026-6922: WP Table Builder <= 2.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameter
The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trashtablebulk() and restoretablebulk() functions that causes the guard to never fire, combined with a permission callback that only verifies plugin role membership without per-post-type or ownership checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to trash or restore any post, page, or custom post type on the site by supplying arbitrary post IDs.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with subscriber-level access or higher can exploit it. The affected permission check verifies plugin role membership but does not enforce ownership or post-type-specific authorization.
What content can be affected?
An attacker can supply arbitrary post IDs to trash or restore posts, pages, and custom post types on the site. They do not need to own the targeted content.
Are sites with only trusted administrators at risk?
Exploitation requires an authenticated account, so exposure depends on whether lower-privileged users can log in. Sites that allow subscriber or other non-administrative accounts are directly exposed to misuse by those accounts.
How can I identify potential exploitation?
Review WordPress content status changes for posts, pages, and custom post types that were unexpectedly moved to the trash or restored. Pay particular attention to actions associated with subscriber-level or other low-privileged accounts.