{
 "id": "WPSEC-2026-2293",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2293/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2293/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2293/index.md",
 "title": "Data Tables Generator by Supsystic <= 1.15.7 - Unauthenticated Insecure Direct Object Reference to Table Data Exposure via 'id' Parameter",
 "description": "The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'id' parameter of the front-end getPageRows AJAX action in all versions up to, and including, 1.15.7, due to the handler accepting a generic front-end nonce that is printed on every front-end page and not checking that the requested table was displayed to the visitor. This makes it possible for unauthenticated attackers to retrieve the rendered rows of any table by its ID, including tables that are not embedded on any public page.",
 "plugin": {
  "slug": "data-tables-generator-by-supsystic",
  "name": "Data Tables Generator by Supsystic",
  "full_name": "Data Tables Generator by Supsystic – Excel-like, WooCommerce & Pricing Tables",
  "wordpress_org": "https://wordpress.org/plugins/data-tables-generator-by-supsystic/",
  "advisories_url": "https://wpsec.com/vuln/plugin/data-tables-generator-by-supsystic/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/data-tables-generator-by-supsystic"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.15.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.15.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.15.8",
 "remediation": "Update to 1.15.8 or later.",
 "fix_released": "2026-11-02T13:36:53+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:19:42.639050+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2293/",
  "https://plugins.svn.wordpress.org/data-tables-generator-by-supsystic/tags/1.15.8/",
  "https://wordpress.org/plugins/data-tables-generator-by-supsystic/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/data-tables-generator-by-supsystic",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}