WordPress Table Builder for Data Tables, WooCommerce Product Tables & Post Tables <= 2.4.0 - Authenticated (Contributor+) Sensitive Information Exposure via tableKit Shortcode
- ID
- WPSEC-2026-2816
- Plugin
- TableKit – WordPress Table Builder for Data Tables, WooCommerce Product Tables & Post Tables (table-builder-block)
- Affected
- from 2.2.5 before 2.4.1
- Remediation
- Update to 2.4.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-10
- Attack surface
- WordPress Table Builder for Data Tables, WooCommerce Product Tables & Post Tables on WPSec AttackSurface
- Fix released
- Published
Description
The WordPress Table Builder for Data Tables, WooCommerce Product Tables & Post Tables plugin for WordPress is vulnerable to Sensitive Information Exposure via the [tableKit] shortcode in all versions up to, and including, 2.4.0. This is due to the shortcode loading tables and post content from any published post by ID without checking whether the post is password protected. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed the shortcode in their own posts and read the tables, and with only a post ID the full rendered content, of password-protected posts without knowing the password.
References
- https://wpsec.com/vuln/WPSEC-2026-2816/
- https://plugins.svn.wordpress.org/table-builder-block/tags/2.4.1/
- https://wordpress.org/plugins/table-builder-block/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS