CyberRota Analysis
AI-GeneratedThe WP Table Builder plugin for WordPress is vulnerable due to an incorrect authorization flaw that allows authenticated users with subscriber-level access and above to manipulate any post, page, or custom post type by supplying arbitrary post IDs. This vulnerability arises from a bug in the post-type guard within specific functions, which fails to enforce proper ownership checks. WordPress site administrators using this plugin should prioritize patching or updating to mitigate the risk of unauthorized content manipulation.
Original NVD Description
The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions that causes the guard to never fire, combined with a permission callback that only verifies plugin role membership without per-post-type or ownership checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to trash or restore any post, page, or custom post type on the site by supplying arbitrary post IDs.