CVE-2026-4119-nvd.nist.gov-Deferred

The Create DB Tables plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.1. The plugin registers admin_post actio…

Published:

21 April 2026 at 22:00:00

Alert date:

22 April 2026 at 22:11:22

Source:

nvd.nist.gov

Web Technologies, Database & Storage

The Create DB Tables plugin for WordPress versions up to 1.2.1 contains a critical authorization bypass vulnerability. The plugin fails to implement proper capability checks or nonce verification for admin_post action hooks, allowing any authenticated user including Subscribers to access table creation and deletion endpoints. Attackers can exploit the cdbt_delete_db_table() function to execute DROP TABLE SQL queries against any database table, including critical WordPress core tables like wp_users or wp_options. The vulnerability also allows creation of arbitrary database tables through the cdbt_create_new_table() function, potentially enabling complete destruction of WordPress installations.

Technical details

Mitigation steps:

Affected products:

WordPress Create DB Tables Plugin

Related links:

Related CVE's:

CVE-2026-4119

Related threat actors:

IOC's:

This article was created with the assistance of AI technology by Perceptive.