WordPress Plugin Vulnerability Lets Subscribers Wreck Databases

The National Vulnerability Database (NVD) has identified a critical authorization bypass flaw in the Create DB Tables WordPress plugin, affecting all versions up to 1.2.1. The vulnerability allows any authenticated user, even those with basic Subscriber privileges, to execute arbitrary SQL commands. Specifically, attackers can leverage the admin_post action hooks to delete any database table, including core WordPress tables like wp_users, or create new, arbitrary tables. This effectively grants them the power to destroy an entire WordPress installation.

The core issue, as detailed by the NVD, stems from the plugin’s failure to implement proper capability checks (current_user_can()) or nonce verification (wp_verify_nonce()) on its table creation and deletion endpoints. The attacker’s calculus here is simple: gain low-level access, exploit the unauthenticated endpoints, and cause maximum disruption. The CVSS score of 9.1 (Critical) underscores the severity, as it requires no special privileges beyond basic authentication and can lead to complete data loss or system compromise.