CVE-2026-18881

Name of the Vulnerable Software and Affected Versions TableOn – WordPress Posts Table Filterable versions prior to 1.0.5.2

Description Unauthenticated attackers can perform blind SQL Injection through the filter data[comment count] parameter of the public tableon get table data AJAX action. The issue occurs because user-supplied input is split on a colon and interpolated directly into a posts where SQL clause without using intval() casting or $wpdb->prepare(). This allows the execution of additional SQL queries to extract sensitive data from the database, such as database names, usernames, and passwords.

Recommendations Update to a version newer than 1.0.5.1. As a temporary workaround, restrict access to the tableon get table data AJAX action to minimize the risk of exploitation.