PT-2026-34290 · Primisdigital · Wp Table Manager

Itthidej Aramsri · Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-4126

Mitre

CVSS v3.1

4.3

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

The Table Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0 via the 'table manager' shortcode. The shortcode handler tablemanager render table shortcode() takes a user-controlled table attribute, applies only sanitize key() for sanitization, and concatenates the value with $wpdb->prefix to form a full database table name. It then executes DESC and SELECT * queries against this table and renders all rows and columns to the frontend. There is no allowlist check to ensure only plugin-created tables can be accessed — the tablemanager created tables option is only referenced in admin functions, never in the shortcode handler. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data from arbitrary WordPress database tables.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-4126

Affected Products

Wp Table Manager

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-4126 · Security Note
• https://plugins.trac.wordpress.org/browser/table-manager/trunk/table-manager.php#L573 · Note
• https://plugins.trac.wordpress.org/browser/table-manager/trunk/table-manager.php#L572 · Note
• https://plugins.trac.wordpress.org/browser/table-manager/tags/1.0.0/table-manager.php#L561 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/25b3607c-f99e-4359-8228-0f3452f80aac?source=cve · Note
• https://plugins.trac.wordpress.org/browser/table-manager/trunk/table-manager.php#L561 · Note
• https://plugins.trac.wordpress.org/browser/table-manager/tags/1.0.0/table-manager.php#L573 · Note
• https://plugins.trac.wordpress.org/browser/table-manager/tags/1.0.0/table-manager.php#L572 · Note