CVE-2026-4119Create DB Tables <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Table Creation/Deletion via admin-post.php
- 9.1CriticalCVSS base score
- 0.73%Exploitation in 30 daysEPSS · top 45% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
The Create DB Tables plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.1. The plugin registers admin_post action hooks for creating tables (admin_post_add_table) and deleting tables (admin_post_delete_db_table) without implementing any capability checks via current_user_can() or nonce verification via wp_verify_nonce()/check_admin_referer(). The admin_post hook only requires the user to be logged in, meaning any authenticated user including Subscribers can access these endpoints. The cdbt_delete_db_table() function takes a user-supplied table name from $_POST['db_table'] and executes a DROP TABLE SQL query, allowing any authenticated attacker to delete any database table including critical WordPress core tables such as wp_users or wp_options. The cdbt_create_new_table() function similarly allows creating arbitrary tables. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary database tables and delete any existing database table, potentially destroying the entire WordPress installation.
Timeline
ID reserved
By Wordfence
- 40 days later
· 40 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| WordfenceCNA (assigner) | 3.1 | Critical9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
| NVDNVD · Deferred | 3.1 | Critical9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.73% · top 45% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.1.
Affected products
- affected ≤ 1.2.1
References
References13
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d1a3bc4b-cc17-4728-b242-13841b5f7660?source=cve (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/create-db-tables/trunk/create-db-tables.php#L376 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/create-db-tables/tags/1.2.1/create-db-tables.php#L376 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/create-db-tables/trunk/create-new-table.php#L69 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/create-db-tables/tags/1.2.1/create-new-table.php#L69 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/create-db-tables/trunk/create-db-tables.php#L370 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/create-db-tables/tags/1.2.1/create-db-tables.php#L370 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/create-db-tables/trunk/create-new-table.php#L14 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/create-db-tables/tags/1.2.1/create-new-table.php#L14 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/create-db-tables/trunk/create-db-tables.php#L405 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/create-db-tables/tags/1.2.1/create-db-tables.php#L405 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/create-db-tables/trunk/create-db-tables.php#L408 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/create-db-tables/tags/1.2.1/create-db-tables.php#L408 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-24662 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-4119)Record last updated .