CVE-2026-4119 json
Create DB Tables <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Table Creation/Deletion via admin-post.php
published 6mo ago modified 4mo ago also EUVD-2026-24662
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
The Create DB Tables plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.1. The plugin registers admin_post action hooks for creating tables (admin_post_add_table) and deleting tables (admin_post_delete_db_table) without implementing any capability checks via current_user_can() or nonce verification via wp_verify_nonce()/check_admin_referer(). The admin_post hook only requires the user to be logged in, meaning any authenticated user including Subscribers can access these endpoints. The cdbt_delete_db_table() function takes a user-supplied table name from $_POST['db_table'] and executes a DROP TABLE SQL query, allowing any authenticated attacker to delete any database table including critical WordPress core tables such as wp_users or wp_options. The cdbt_create_new_table() function similarly allows creating arbitrary tables. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary database tables and delete any existing database table, potentially destroying the entire WordPress installation.
Is CVE-2026-4119 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6mo ago
Exploit prediction
0.73% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Affected products
- jppreus Create DB Tables
Classification
- Weakness
-
- CWE-862 Missing Authorization
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/d1a3bc4b-cc17-4728-b242-13841b5f7660?source=cve
- plugins.trac.wordpress.org /browser/create-db-tables/trunk/create-db-tables.php#L376
- plugins.trac.wordpress.org /browser/create-db-tables/tags/1.2.1/create-db-tables.php#L376
- plugins.trac.wordpress.org /browser/create-db-tables/trunk/create-new-table.php#L69
- plugins.trac.wordpress.org /browser/create-db-tables/tags/1.2.1/create-new-table.php#L69
- plugins.trac.wordpress.org /browser/create-db-tables/trunk/create-db-tables.php#L370
- plugins.trac.wordpress.org /browser/create-db-tables/tags/1.2.1/create-db-tables.php#L370
- plugins.trac.wordpress.org /browser/create-db-tables/trunk/create-new-table.php#L14
- plugins.trac.wordpress.org /browser/create-db-tables/tags/1.2.1/create-new-table.php#L14
- plugins.trac.wordpress.org /browser/create-db-tables/trunk/create-db-tables.php#L405
- plugins.trac.wordpress.org /browser/create-db-tables/tags/1.2.1/create-db-tables.php#L405
- plugins.trac.wordpress.org /browser/create-db-tables/trunk/create-db-tables.php#L408
- plugins.trac.wordpress.org /browser/create-db-tables/tags/1.2.1/create-db-tables.php#L408
Sources
- CVE List CVE-2026-4119
- NVD CVE-2026-4119
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.