CVE-2026-18881

CVE-2026-18881 is a pre-authentication SQL injection in the TableOn WordPress plugin. The vulnerability lives in the `tableon_get_table_data` AJAX handler, which accepts a user-supplied value from `filter_data[comment_count]`, splits it on the colon character, and interpolates both resulting fragments directly into a `posts_where` SQL clause. There is no parameterized query, no type casting, and no sanitization applied to either fragment. The developer's mental model appears to have been that splitting the input on `:` somehow provides protection — perhaps treating the format as `operator:value` (like `gt:5`). This is a critical misconception. String transformation is not sanitization. The split operation does nothing to neutralize SQL metacharacters in either piece. The second fragment was likely intended to be an integer, so no explicit `intval()` was applied, yet nothing enforces that contract. The blast radius here is severe. Because the plugin hooks into WordPress's `posts_where` filter, the injected SQL appends to queries that WordPress executes against every post in the database — not just posts managed by TableOn, but all post types, pages, and custom post types registered by any plugin on the site. In typical shared-hosting deployments where `$wpdb` runs as a database user with access to multiple databases, this vulnerability can potentially reach beyond the target site's data into other databases on the same MySQL instance. The CVSS 7.5 is misleading. An unauthenticated attacker with no special conditions required — just an HTTP request to the AJAX endpoint — can extract arbitrary data from the database, including user credentials. This is not a medium-severity issue. The EPSS score of 0.00376 reflects the fact that automated scanners struggle with this injection shape (the payload is fragmented across two interpolation points), so exploitation doesn't show up in the automated exploitation data that EPSS feeds on. This does not mean the vulnerability is less severe in practice — it means attackers would find it through targeted recon rather than mass scanning, which is actually more dangerous for sites running this plugin. To assess exposure: verify whether the TableOn plugin is installed and check the version. The vulnerability exists through version 1.0.5.1. If the plugin is active, disable it or apply any available update immediately. The correct fix involves applying `intval()` to the second fragment (the numeric argument) and wrapping the operator comparison in `$wpdb->prepare()`. Two lines of code eliminate the entire vulnerability — but that triviality is precisely what makes this failure so damning: the fix has existed in WordPress for over a decade, and the plugin has apparently been distributed without either being caught in review or corrected in any update.

Reviewed through automated stages and approved by a human before publication.