TableOn public comment_count filter permits blind SQL injection
TableOn through 1.0.5.1 exposes the tableon_get_table_data AJAX action to unauthenticated callers. The filter_data[comment_count] value is split on a colon and both attacker-controlled halves are interpolated directly into a posts_where clause without integer conversion or $wpdb->prepare(). An attacker can perform blind SQL injection and extract sensitive database contents; the researcher demonstrated database(), wp_users.user_login and wp_users.user_pass extraction. The CNA does not disclose the callback name or complete query.
- Component
- TableOn – WordPress Posts Table Filterable
- Plugin slug
posts-table-filterable- Affected
- <= 1.0.5.1
- Safe version
> 1.0.5.1- Published
- Aug 05, 2026
This CVE was published Aug 05, 2026 and is one of 9 known issues for this plugin.
Update, patch or deactivate.
Update TableOn to a release after 1.0.5.1. Although tag 1.0.6 is referenced, the authoritative record does not explicitly identify it as the first fixed release. Review public AJAX traffic for SQL-injection probes and rotate database-derived secrets if exploitation is suspected.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the `filter_data[comment_count]` parameter of the public `tableon_get_table_data` AJAX action in all versions up to, and including, 1.0.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query — the value is split on `:` and both halves are interpolated directly into a `posts_where` SQL clause without `intval()` casting or `$wpdb->prepare()`. This makes it possible for unauthenticated attackers to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database (researcher demonstrated extraction of database(), wp_users.user_login, and wp_users.user_pass).
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N