CVE Intelligence
Analysis AI-assisted

CVE-2026-4119: Create DB Tables for WordPress - Missing Authorization

The Create DB Tables plugin for WordPress lacks capability and nonce checks on its table creation and deletion actions, so any logged-in user, including Subscribers, can reach them. According to the record, this can allow arbitrary table creation and deletion, including core WordPress tables. The record lists a CVSS 3.1 score of 9.1 (critical), and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The Create DB Tables plugin for WordPress registers admin_post action hooks for creating and deleting database tables. According to the record, these hooks do not check user capabilities or verify a nonce, so the only requirement is being logged in. The vulnerability is classified as CWE-862 (Missing Authorization). The description states that all versions up to and including 1.2.1 are affected.

Impact

  • Any authenticated user with Subscriber-level access or higher may be able to reach the affected actions, according to the record.
  • The record states that an attacker could delete any database table, including core WordPress tables such as wp_users or wp_options, which could disrupt or destroy the site.
  • The record also states that arbitrary tables can be created.
  • The NVD entry carries a CVSS 3.1 base score of 9.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, which indicates high integrity and availability impact. Confidentiality impact is rated none in that vector.

Affected products and versions

  • Product: Create DB Tables plugin for WordPress.
  • Versions: the description states all versions up to and including 1.2.1. The structured affected-product data in the record is empty, so the exact range is taken from the description only.
  • Later versions, if any exist, are not addressed in the record.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation is reported there. No confirmed exploitation appears in the sources consulted. The EPSS probability in the record is 0.00891, with a percentile of 0.58338. These values estimate likelihood and do not confirm exploitation.

Remediation and mitigation

  • Identify every site running the Create DB Tables plugin and check its installed version.
  • The record does not identify a fixed version. Check the plugin developer's channels and the WordPress plugin repository for an updated release, and apply it when available.
  • If no fix is available, consider removing or deactivating the plugin until a patched version is confirmed.
  • Limit account creation and review existing low-privilege accounts, since any logged-in user is in scope.
  • Take and verify current database backups before making changes, because the impact described includes table deletion.

Detection guidance

  • Review web server and WordPress logs for requests to admin-post endpoints associated with this plugin from accounts that should not manage database structures.
  • Monitor the database for unexpected table creation or drop events, especially for core WordPress tables.
  • Compare the list of database tables against a known-good baseline to spot missing or unexpected tables.

Limitations of the available information

  • The record does not give a fixed version, a patch status, or a vendor advisory beyond the Wordfence entry.
  • The record's source status is Deferred, so details may change.
  • The affected and fixed product lists are empty in the structured data.
  • No confirmed exploitation was found in the sources consulted, but this does not rule out exploitation.

Frequently asked questions

Which versions of the Create DB Tables plugin are affected?

The description states that all versions up to and including 1.2.1 are affected. The record does not list a fixed version, so check the plugin developer or WordPress plugin repository for an updated release.

Can attackers with low privileges exploit this issue?

According to the record, any authenticated user, including Subscribers, can reach the affected actions because they lack capability and nonce checks. No confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.