CVE-2026-18881: SQL Injection in TableOn WordPress Plugin

The TableOn - WordPress Posts Table Filterable plugin for WordPress is vulnerable to a blind SQL injection vulnerability identified as CVE-2026-18881. This flaw affects all versions up to and including 1.0.5.1. The vulnerability exists within the public tableon_get_table_data AJAX action, specifically due to improper handling of the filter_data[comment_count] parameter. The plugin fails to apply necessary input validation or sanitization, such as intval() casting, and fails to use the $wpdb->prepare() function when processing this parameter. Consequently, the input is interpolated directly into a posts_where SQL clause after being split by a colon delimiter. Unauthenticated attackers can leverage this flaw to append malicious SQL commands, enabling them to execute blind SQL injection attacks to exfiltrate sensitive data from the WordPress database, including entries from the wp_users table.

Impact

Successful exploitation allows unauthenticated remote attackers to perform blind SQL injection against the host WordPress site. Potential consequences include the exfiltration of sensitive information, such as administrator hashes or user credentials, which could lead to complete site compromise. Given the prevalence of WordPress plugins in enterprise environments, this poses a high risk to sites utilizing the TableOn plugin.

Recommendation

• Upgrade the TableOn - WordPress Posts Table Filterable plugin to the latest version released after August 5, 2026, which contains the security patch for CVE-2026-18881.
• Implement a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests targeting the tableon_get_table_data action where the filter_data[comment_count] parameter contains SQL-specific characters or patterns.
• Audit database query logs for suspicious patterns originating from external IP addresses targeting the affected AJAX endpoint.