PT-2026-34287 · WordPress · Create Db Tables

Youcef Hamdani · Published 2026-04-22 · Updated 2026-05-06 · CVE-2026-4119

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Create DB Tables versions prior to 1.2.2

Description The Create DB Tables plugin for WordPress contains an authorization bypass. The plugin registers admin post action hooks for creating tables ('admin post add table') and deleting tables ('admin post delete db table') without implementing capability checks or nonce verification. Consequently, any authenticated user, including those with Subscriber-level access, can access these endpoints. The cdbt delete db table() function processes a user-supplied table name from the db table variable and executes a DROP TABLE SQL query, which allows the deletion of any database table, including critical WordPress core tables. Similarly, the cdbt create new table() function allows the creation of arbitrary database tables.

Recommendations Update to a version newer than 1.2.1. As a temporary workaround, restrict access to the 'admin post add table' and 'admin post delete db table' endpoints to authorized administrators only.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4119

Affected Products

Create Db Tables

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2026-4119 · Security Note
• https://reddit.com/r/StopBadBots/comments/1t0qbbs/critical_alert_20_unpatched_wordpress · Reddit Post
• https://twitter.com/MNovofastovsky/status/2051924927486566548 · Twitter Post
• https://twitter.com/0dayPublishing/status/2046867853337342181 · Twitter Post
• https://plugins.trac.wordpress.org/browser/create-db-tables/tags/1.2.1/create-new-table.php#L69 · Note
• https://plugins.trac.wordpress.org/browser/create-db-tables/trunk/create-db-tables.php#L408 · Note
• https://plugins.trac.wordpress.org/browser/create-db-tables/trunk/create-new-table.php#L69 · Note
• https://plugins.trac.wordpress.org/browser/create-db-tables/tags/1.2.1/create-new-table.php#L14 · Note
• https://plugins.trac.wordpress.org/browser/create-db-tables/tags/1.2.1/create-db-tables.php#L405 · Note
• https://plugins.trac.wordpress.org/browser/create-db-tables/trunk/create-db-tables.php#L370 · Note
• https://plugins.trac.wordpress.org/browser/create-db-tables/tags/1.2.1/create-db-tables.php#L370 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d1a3bc4b-cc17-4728-b242-13841b5f7660?source=cve · Note
• https://twitter.com/CVEnew/status/2047428112817025238 · Twitter Post
• https://plugins.trac.wordpress.org/browser/create-db-tables/trunk/create-db-tables.php#L376 · Note
• https://plugins.trac.wordpress.org/browser/create-db-tables/tags/1.2.1/create-db-tables.php#L408 · Note