CVE-2026-4119 Missing authorization in Create DB Tables
Authenticated subscribers can arbitrarily create or delete database tables, potentially destroying the WordPress installation, due to missing capability checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-4119?
CVE-2026-4119 is a critical missing authorization vulnerability in jppreus Create DB Tables, published on 22 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Create DB Tables plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.1. The plugin registers admin_post action hooks for creating tables (admin_post_add_table) and deleting tables (admin_post_delete_db_table) without implementing any capability checks via current_user_can() or nonce verification via wp_verify_nonce()/check_admin_referer(). The admin_post hook only requires the user to be logged in, meaning any authenticated user including Subscribers can access these endpoints. The cdbt_delete_db_table() function takes a user-supplied table name from $_POST['db_table'] and executes a DROP TABLE SQL query, allowing any authenticated attacker to delete any database table including critical WordPress core tables such as wp_users or wp_options. The cdbt_create_new_table() function similarly allows creating arbitrary tables. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary database tables and delete any existing database table, potentially destroying the entire WordPress installation.
Weakness: CWE-862
Which versions are affected by CVE-2026-4119?
How do I fix CVE-2026-4119?
No fix has been published for CVE-2026-4119 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-4119 being exploited?
There is no known exploitation of CVE-2026-4119 in the wild and no public exploit code.
Sources
Also known as GHSA-jpj9-vrh6-4wmc.