CVE-2026-6922 Missing authorization in WP Table Builder – Drag & Drop Table Builder
Authenticated subscribers can arbitrarily delete or restore any post due to incorrect authorization checks in the WP Table Builder plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-6922?
CVE-2026-6922 is a high-severity missing authorization vulnerability in wptb WP Table Builder – Drag & Drop Table Builder, published on 22 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions that causes the guard to never fire, combined with a permission callback that only verifies plugin role membership without per-post-type or ownership checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to trash or restore any post, page, or custom post type on the site by supplying arbitrary post IDs.
Weakness: CWE-863
Which versions are affected by CVE-2026-6922?
How do I fix CVE-2026-6922?
No fix has been published for CVE-2026-6922 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-6922 being exploited?
There is no known exploitation of CVE-2026-6922 in the wild and no public exploit code.
Sources
Also known as GHSA-v8f2-9v32-fmmf.