Authorization Bypass in WP Table Builder Plugin

The WP Table Builder - Drag & Drop Table Builder plugin for WordPress is affected by an incorrect authorization vulnerability (CVE-2026-6922) present in all versions up to and including 2.2.1. The flaw resides within the trash_table_bulk() and restore_table_bulk() functions. Due to an operator precedence error in the post-type validation guard, the security check fails to execute as intended. Furthermore, the permission callback associated with these functions only verifies that the user possesses a plugin-specific role, failing to perform necessary per-post-type or ownership checks. Consequently, any authenticated user - including those with low-privileged subscriber access - can provide arbitrary post IDs to trash or restore any content on the WordPress installation, including posts, pages, and custom post types. This vulnerability poses a significant risk to site integrity and availability.

Impact

Successful exploitation allows authenticated users with minimal privileges to perform unauthorized administrative actions against site content. Attackers can mass-trash or restore posts and pages, potentially causing widespread service disruption, content loss, or unauthorized content visibility changes. This vulnerability affects any WordPress site utilizing the vulnerable version of the WP Table Builder plugin.

Recommendation

• Upgrade the WP Table Builder - Drag & Drop Table Builder plugin to a version released after 2.2.1 immediately to resolve CVE-2026-6922.
• Review audit logs for trash_table_bulk or restore_table_bulk function calls initiated by accounts with subscriber-level permissions.
• Restrict administrative plugin access and sensitive action capabilities to high-privileged roles until the patch is applied.