CVE-2026-18881

TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter

2026-08-04 18:28
Athiwat Tiprasaharn (Jitlada)

Strategic Overview

Status
Patched in 1.0.6
Affected Plugin
TableOn – WordPress Posts Table Filterable 
Affected Version
<= 1.0.5.1
CVSS
7.5High
Weakness type
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE
CVE-2026-18881
View all TableOn – WordPress Posts Table Filterable  vulnerabilities

At a glance

CVE-2026-18881 is a high-severity Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in the TableOn WordPress plugin, affecting versions <= 1.0.5.1. It carries a CVSS score of 7.5 (reachable over the network; low attack complexity; high confidentiality impact). Exploitation requires no authentication. The issue is fixed in version 1.0.6; sites on affected versions should update now. Disclosed August 2026, reported by Athiwat Tiprasaharn (Jitlada).

Vulnerability Overview

The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the `filter_data[comment_count]` parameter of the public `tableon_get_table_data` AJAX action in all versions up to, and including, 1.0.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query — the value is split on `:` and both halves are interpolated directly into a `posts_where` SQL clause without `intval()` casting or `$wpdb->prepare()`. This makes it possible for unauthenticated attackers to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database (researcher demonstrated extraction of database(), wp_users.user_login, and wp_users.user_pass).

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user. A successful exploit has high impact on confidentiality.

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

TableOn <= 1.0.5.1 carries this weakness at intval(), and reaching it takes no account at all. SQL injection happens when request data is concatenated into a query instead of being bound as a parameter, letting an attacker change the structure of the statement rather than just its values.

A working injection can read any table the database user can see, which on a WordPress install means user records, password hashes and session or API secrets stored in options. For TableOn the fix is 1.0.6: builds <= 1.0.5.1 are affected, anything from 1.0.6 onward is not.

Remediation

Update to version 1.0.6, or a newer patched version

How WordSec helps

Requests carrying this pattern arrive without a session, so nothing upstream of the firewall gets a chance to reject them: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: TableOn 1.0.6 closes this, and updating the plugin is the step that ends it.

  • Firewall
  • Login Security
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2026-18881https://www.wordfence.com/threat-intel/vulnerabilities/id/ac53ade6-b654-4169-a50a-96b3de3d108dhttps://nvd.nist.gov/vuln/detail/CVE-2026-18881

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C