WP Table Builder, a WordPress table plugin running on more than 50,000 sites, has a high-severity authorization flaw that lets any logged-in subscriber trash or restore any post, page, or custom post type on the site. Tracked as CVE-2026-6922 and disclosed on September 22, 2026, the bug carries a CVSS score of 7.1. It’s already fixed in version 2.2.2, so the fastest fix is also the simplest one: update.
What’s Actually Broken
The flaw sits in two functions, trash_table_bulk() and restore_table_bulk(), that the plugin uses to bulk-manage its table post type. According to Wordfence’s advisory, an operator precedence bug in the post-type guard means that check never actually fires. On top of that, the permission callback only confirms a user holds a role the plugin recognizes, without checking whether they own the post or even whether it’s a table at all.
Put those two gaps together and an authenticated attacker with subscriber-level access, the default role WordPress hands out for open registration, WooCommerce customer accounts, and most membership plugins, can submit arbitrary post IDs and trash or restore any content type on the site. Not just tables. Any post, any page, any custom post type.
Who Needs to Act on This
If your site runs WP Table Builder version 2.2.1 or earlier and allows any form of self-registration, whether that’s open commenting, a WooCommerce checkout that creates customer accounts, or a membership signup flow, you have users sitting at exactly the privilege level this bug needs. The plugin itself doesn’t have to be visibly in use anywhere for the flaw to be exploitable; the vulnerable endpoints just need to be reachable.
The practical risk here isn’t data theft, it’s disruption. A malicious subscriber could quietly trash product pages, blog posts, or service pages, and depending on how closely a site is monitored, that could go unnoticed for a while.
What to Do
- Update WP Table Builder to version 2.2.2 or later immediately.
- Check your Trash for anything that shouldn’t be there, especially if the site allows public registration.
- Review recently created subscriber accounts for anything that looks automated or unfamiliar.
- If you don’t actually need open registration, turn it off.
This is also a reminder that a plugin’s core feature set (in this case, building tables) says nothing about how carefully its admin-facing endpoints are locked down. If you’re not sure which plugins on a client site carry this kind of risk, a WordPress Development audit is the place to catch it before a subscriber account does.
