WP Table Builder <= 2.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameter
Strategic Overview
- Status
- Patched in 2.2.2
- Affected Plugin
- WP Table Builder – Drag & Drop Table Builder
- Affected Version
<= 2.2.1- CVSS
- 7.1High
- Weakness type
- CWE-863 · Incorrect Authorization
- CVE
CVE-2026-6922
At a glance
CVE-2026-6922 is a high-severity Incorrect Authorization vulnerability in the WP Table Builder WordPress plugin, affecting versions <= 2.2.1. It carries a CVSS score of 7.1 (reachable over the network; low attack complexity; high availability impact). Exploitation requires an authenticated account at Subscriber level or above. The issue is fixed in version 2.2.2; sites on affected versions should update now. Disclosed September 2026, reported by Quốc Huy (jtwings).
Vulnerability Overview
The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions that causes the guard to never fire, combined with a permission callback that only verifies plugin role membership without per-post-type or ownership checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to trash or restore any post, page, or custom post type on the site by supplying arbitrary post IDs.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user. A successful exploit has high impact on availability.
CWE-863: Incorrect Authorization
WP Table Builder <= 2.2.1 carries this weakness at trash_table_bulk(), and reaching it takes an account at Subscriber level or above. Incorrect authorization means a permission check exists but evaluates the wrong thing, so it passes for callers it was meant to stop.
The action runs for users the code intended to exclude, with the same effect as having no check at all. For WP Table Builder the fix is 2.2.2: builds <= 2.2.1 are affected, anything from 2.2.2 onward is not.
Remediation
Update to version 2.2.2, or a newer patched version
How does WordSec protect against this?
Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: WP Table Builder 2.2.2 closes this, and updating the plugin is the step that ends it.
- Login Security
- Alerts
External References
Related records
Same weakness class
Other vulnerabilities in WP Table Builder – Drag & Drop Table Builder
- 6.4CVE-2025-8604: WP Table Builder – WordPress Table Plugin Stored XSS
CVE-2025-8604 - 6.4CVE-2025-55711: WP Table Builder <= 2.0.12 Stored Cross-Site Scripting
CVE-2025-55711 - 6.4CVE-2024-43125: WP Table Builder – WordPress Table Plugin Stored XSS
CVE-2024-43125 - 6.4CVE-2024-4700: WP Table Builder – WordPress Table Plugin Stored XSS
CVE-2024-4700 - 6.3CVE-2022-4974: Freemius SDK <= 2.4.2 Missing Authorization Checks
CVE-2022-4974 - 6.1CVE-2025-32598: WP Table Builder <= 2.0.5 Reflected XSS
CVE-2025-32598 - 6.1CVE-2023-33999: Freemius SDK <= 2.5.9 Reflected Cross-Site Scripting
CVE-2023-33999 - 6.1WP Table Builder – WordPress Table Plugin <= 1.3.9 Reflected XSS
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C