CVE-2025-13753: 
WordPress vulnerability analysis and mitigation

CVE-2025-13753 is an incorrect authorization vulnerability in the WP Table Builder – Drag & Drop Table Builder plugin for WordPress. It affects all versions up to and including 2.0.19, and was disclosed on January 9, 2026, by Wordfence. The flaw allows authenticated attackers with Subscriber-level access or higher to create unauthorized wptb-table posts via an improper authorization check in the save_table() function. It carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence).

The root cause is classified as CWE-863 (Incorrect Authorization): the save_table() function in the plugin fails to properly verify whether the authenticated user has sufficient privileges to create new table posts. Because the authorization check is flawed rather than absent, low-privileged users (Subscriber and above) can invoke this function and create wptb-table post entries that should be restricted to higher-privileged roles such as Editor or Administrator. The attack vector is network-based, requires low privileges, and no user interaction, making it straightforward to exploit for any authenticated WordPress user (Wordfence, CleanTalk Research).

Successful exploitation allows low-privileged authenticated users to create and modify table content on the affected WordPress site, resulting in unauthorized data modification (integrity impact). There is no direct confidentiality or availability impact, and the vulnerability does not enable remote code execution or privilege escalation on its own. However, in a multi-user WordPress environment, this could allow subscriber-level accounts to inject unwanted content into the site's table structures, potentially facilitating content defacement or spam (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13753. The EPSS score is approximately 0.026%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least Subscriber-level access, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Obtain Subscriber-level access: Register or log in to the target WordPress site with any authenticated account at Subscriber level or above.
2. Identify the vulnerable endpoint: Locate the AJAX action or REST API endpoint that invokes the save_table() function in the WP Table Builder plugin (versions ≤ 2.0.19).
3. Craft a malicious request: Send an authenticated HTTP POST request to the save_table() endpoint with parameters specifying a new table post, bypassing the flawed authorization check.
4. Create unauthorized table post: The server processes the request without proper privilege verification, creating a new wptb-table post under the attacker's control.
5. Leverage created content: Use the newly created table post to inject unwanted content into pages or posts where the table is embedded (Wordfence, CleanTalk Research).

• Logs: WordPress access logs showing authenticated POST requests to the save_table() AJAX action (e.g., admin-ajax.php with action=wptb_save_table) from Subscriber-level user accounts.
• Database: Unexpected wptb-table post entries in the wp_posts table authored by low-privileged user IDs (Subscriber role).
• File System: No direct file system artifacts expected, but review plugin logs or WordPress debug logs for unauthorized save_table invocations.
• User Activity: Audit logs showing Subscriber-level users performing post creation actions outside their normal scope.

Users should update the WP Table Builder plugin to version 2.0.20 or later, which contains the fix for the incorrect authorization check in save_table() (WordPress Plugin Changeset). As a temporary workaround, site administrators can restrict user registration or limit Subscriber-level accounts on the site until the patch is applied. Reviewing and auditing existing wptb-table posts for unauthorized entries is also recommended after upgrading (Wordfence).

Sucuri included CVE-2025-13753 in their January 2026 vulnerability patch roundup, noting it as part of a broader set of WordPress plugin issues requiring attention (Sucuri Blog). CleanTalk Research published a dedicated write-up on the vulnerability (CleanTalk Research). General community reaction has been muted given the low severity and limited exploitation potential.