ZeroDay Findings
Sign inSign up

Findings

CVE-2026-4126

The Table Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0 via the 'table_manager' shortcode.

Published Apr 22, 2026 · updated Jun 17, 2026

The Table Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0 via the 'table_manager' shortcode. The shortcode handler takes a user-controlled attribute, applies only for sanitization, and concatenates the value with to form a full database table name. It then executes and queries against this table and renders all rows and columns to the frontend. There is no allowlist check to ensure only plugin-created tables can be accessed — the option is only referenced in admin functions, never in the shortcode handler. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data from arbitrary WordPress database tables.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 22, 2026 · NIST NVD

    Detected

    The Table Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0 via the 'table_manager' shortcode. The shortcode handler takes a user-controlled attribute, applies only for sanitization, and concatenates the value with to form a full database table name. It then executes and queries against this table and renders all rows and colum

  2. Jun 17, 2026 · NIST NVD

    Updated

    The Table Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0 via the 'table_manager' shortcode. The shortcode handler takes a user-controlled attribute, applies only for sanitization, and concatenates the value with to form a full database table name. It then executes and queries against this table and renders all rows and colum

Sources

  • CVE.orgVulnerability recordCVE-2026-4126

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-4126

    The Table Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0 via the 'table_manager' shortcode. The shortcode handler takes a user-controlled attribute, applies o

    nvd.nist.gov

References