The Table Manager WordPress plugin contains a flaw that allows an authenticated user with Contributor level or higher to reveal arbitrary database content. The plugin’s shortcode processor accepts a "table" parameter, sanitizes it only with a key validation routine, then combines it with the database prefix and runs a DESCRIBE command followed by a SELECT * on the resulting table. Because the processor does not enforce an allow‑list of plugin‑created tables, an attacker can specify any table name and have its entire contents exposed on the front end.

All installations of primisdigital’s Table Manager plugin with a version of 1.0.0 or earlier are affected. The vulnerability exists in the default deployment of the plugin and is not limited to any particular WordPress installation configuration.

The CVSS score of 4.3 indicates a moderate risk, and the exploitation likelihood is not quantified due to missing EPSS data. The attack requires authenticated access at the Contributor level, which many sites assign to content editors. Once authenticated, an attacker can embed the malicious shortcode in a post or page they can edit and trigger a direct leak of arbitrary database table data to any viewer of that content. The plugin is not listed in the CISA KEV catalog, so there is no formal indication of active exploitation at this time.