CVE-2026-42755: WordPress TableOn Plugin - Blind SQL Injection

Overview\n\nCVE-2026-42755 describes a blind SQL injection (CWE-89) in the TableOn plugin for WordPress, published by RealMag777 under the posts-table-filterable name. The record states that versions up to and including 1.0.5.1 are affected. It was published on 2026-05-27 and the CNA is Patchstack, which lists the entry in its vulnerability database.\n\n## Impact\n\nThe record states that the flaw allows blind SQL injection, meaning an attacker could influence database queries and infer data without direct output. Patchstack's CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) describes network reachability, low complexity, no privileges and no user interaction required, with high confidentiality impact, no integrity impact and low availability impact. The SSVC data in the record rates technical impact as partial, exploitation as none and the issue as automatable.\n\n## Affected products and versions\n\n- RealMag777 TableOn (posts-table-filterable), versions up to and including 1.0.5.1, as stated in the record.\n- The record does not list any fixed version. This does not mean no fix exists; it means the record is silent on one.\n\n## Exploitation status\n\nThe record shows that CISA KEV does not list this CVE. No confirmed active exploitation appears in the sources consulted for this analysis. EPSS reports a probability of 0.004 (about 0.4 percent) with a percentile of 0.32411, and SSVC marks exploitation as none.\n\n## Remediation and mitigation\n\n- Identify any WordPress site running TableOn or the posts-table-filterable plugin, including versions 1.0.5.1 and earlier.\n- Because no fixed version is listed in the record, check the Patchstack entry and the plugin vendor channels for an update before relying on any upgrade path.\n- If the plugin is not essential, deactivate and remove it until a verified update is available.\n- Restrict the database account used by WordPress to the privileges it truly needs, and keep WordPress core and other plugins current.\n- Consider a web application firewall or virtual patching rule as a temporary compensating control, validated in a test environment first.\n\n## Detection guidance\n\n- Review web server and WAF logs for unusual parameter values sent to TableOn-related endpoints, especially repeated requests with varying inputs that could indicate probing.\n- Monitor database logs for slow or anomalous queries originating from the WordPress application.\n- Inventory plugin versions across all WordPress installations so that exposure can be confirmed quickly.\n\n## Limitations of the available information\n\nThe record provides no affected endpoint, parameter, fixed version, vendor advisory text beyond the short description, or proof-of-concept details, and does not specify the database backend. The CVSS score comes from Patchstack, and the record shows the same 9.3 score under two provider labels. The record's source status is Deferred, and the EPSS date (2026-10-13) is later than the publication date, so the EPSS value should be rechecked against the current feed before use.

Frequently asked questions

Which versions of the TableOn plugin are affected by CVE-2026-42755?

According to the record, versions up to and including 1.0.5.1 are affected. The record does not list a fixed version, so check the vendor and Patchstack entry for updates.

Is CVE-2026-42755 known to be actively exploited?

No. The record shows the CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

What should administrators do now?

Identify affected installations, check for a verified update, remove or deactivate the plugin if it is not essential, restrict database privileges and monitor logs for suspicious database-related activity.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.