# WordPress Table Builder for Data Tables, WooCommerce Product Tables & Post Tables <= 2.4.0 - Authenticated (Contributor+) Sensitive Information Exposure via tableKit Shortcode

- **ID:** WPSEC-2026-2816
- **Plugin:** TableKit – WordPress Table Builder for Data Tables, WooCommerce Product Tables & Post Tables (`table-builder-block`), https://wordpress.org/plugins/table-builder-block/
- **Affected versions:** from 2.2.5 before 2.4.1
- **Fixed in:** 2.4.1 (Update to 2.4.1 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/table-builder-block
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2816/

## Description

The WordPress Table Builder for Data Tables, WooCommerce Product Tables & Post Tables plugin for WordPress is vulnerable to Sensitive Information Exposure via the [tableKit] shortcode in all versions up to, and including, 2.4.0. This is due to the shortcode loading tables and post content from any published post by ID without checking whether the post is password protected. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed the shortcode in their own posts and read the tables, and with only a post ID the full rendered content, of password-protected posts without knowing the password.

## References

- https://wpsec.com/vuln/WPSEC-2026-2816/
- https://plugins.svn.wordpress.org/table-builder-block/tags/2.4.1/
- https://wordpress.org/plugins/table-builder-block/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2816/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.