WordPress Plugin Vulnerabilities

Data Tables Generator by Supsystic < 1.15.8 - Unauthenticated Table Content Disclosure via IDOR

Description

The plugin does not perform any authorization or ownership check before returning the stored contents of a table, relying only on a nonce that is exposed to every anonymous visitor, allowing unauthenticated users to read the full contents of any table by its identifier, including tables that are never published anywhere on the site.

Proof of Concept

Affects Plugins

Plugin icon
data-tables-generator-by-supsystic
Fixed in 1.15.8

References

CVE
CVE-2026-110016

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
John Ryan Albon
Submitter
John Ryan Albon
Verified
Yes
WPVDB ID
3ff8c1cc-3975-4302-a69f-11a4538dd4e8

Timeline

Publicly Published
2026-11-09 (about 2 days ago)
Added
2026-11-09 (about 1 day ago)
Last Updated
2026-11-09 (about 1 day ago)

Other

Published
Title
Published
2026-08-25
Title
WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps < 5.5.69 - Unauthenticated Insecure Direct Object Reference to Data Access
Published
2026-10-14
Title
Social Media Auto Post & Scheduler < 9.1.5 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure
Published
2026-09-30
Title
SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO < 3.1.1 - Unauthenticated Insecure Direct Object Reference
Published
2026-08-17
Title
User Verification < 2.0.48 - Unauthenticated Arbitrary Account Lockout via IDOR
Published
2026-02-17
Title
PawFriends - Pet Shop and Veterinary WordPress <= 1.3 - Authenticated (Subscriber+) Insecure Direct Object Reference