{
 "id": "WPSEC-2026-2816",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2816/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2816/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2816/index.md",
 "title": "WordPress Table Builder for Data Tables, WooCommerce Product Tables & Post Tables <= 2.4.0 - Authenticated (Contributor+) Sensitive Information Exposure via tableKit Shortcode",
 "description": "The WordPress Table Builder for Data Tables, WooCommerce Product Tables & Post Tables plugin for WordPress is vulnerable to Sensitive Information Exposure via the [tableKit] shortcode in all versions up to, and including, 2.4.0. This is due to the shortcode loading tables and post content from any published post by ID without checking whether the post is password protected. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed the shortcode in their own posts and read the tables, and with only a post ID the full rendered content, of password-protected posts without knowing the password.",
 "plugin": {
  "slug": "table-builder-block",
  "name": "WordPress Table Builder for Data Tables, WooCommerce Product Tables & Post Tables",
  "full_name": "TableKit – WordPress Table Builder for Data Tables, WooCommerce Product Tables & Post Tables",
  "wordpress_org": "https://wordpress.org/plugins/table-builder-block/",
  "advisories_url": "https://wpsec.com/vuln/plugin/table-builder-block/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/table-builder-block"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.2.5",
    "from_inclusive": true,
    "to": "2.4.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.2.5 before 2.4.1"
  ]
 },
 "introduced_in": "2.2.5",
 "fixed_in": "2.4.1",
 "remediation": "Update to 2.4.1 or later.",
 "fix_released": "2026-11-09T15:20:32+00:00",
 "published": "2026-11-10T15:48:02+00:00",
 "updated": "2026-11-09T23:34:13.952848+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2816/",
  "https://plugins.svn.wordpress.org/table-builder-block/tags/2.4.1/",
  "https://wordpress.org/plugins/table-builder-block/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/table-builder-block",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-10"
 }
}