CVE-2025-13753 is a vulnerability classified under CWE-863 (Incorrect Authorization) found in the WP Table Builder – Drag & Drop Table Builder plugin for WordPress. The issue lies in the save_table() function, which fails to properly verify user permissions before allowing the creation of new wptb-table posts. This flaw affects all plugin versions up to and including 2.0.19. An attacker with authenticated access at the Subscriber level or higher can exploit this vulnerability to create unauthorized table posts, effectively modifying site content without proper authorization. The vulnerability does not require user interaction beyond authentication and can be exploited remotely over the network. The CVSS 3.1 base score is 4.3, indicating a medium severity level, with the vector highlighting network attack vector, low attack complexity, and low privileges required. While no known exploits are currently reported in the wild, the vulnerability poses a risk to the integrity of affected WordPress sites, potentially allowing attackers to manipulate displayed data or inject misleading information. The lack of a patch at the time of reporting necessitates interim risk management strategies. This vulnerability is particularly relevant for websites relying on the WP Table Builder plugin for content management, as unauthorized table creation could lead to misinformation, defacement, or reputational damage.

For European organizations, this vulnerability primarily threatens the integrity of website content managed via the WP Table Builder plugin. Unauthorized creation of table posts can lead to misinformation, defacement, or insertion of malicious content that could mislead users or damage brand reputation. While confidentiality and availability are not directly impacted, the trustworthiness and reliability of affected websites could be compromised. Organizations in sectors such as e-commerce, media, education, and government that rely on WordPress sites with this plugin may face reputational harm and potential loss of customer confidence. Additionally, attackers could leverage this vulnerability as a foothold for further attacks if combined with other vulnerabilities or social engineering tactics. The medium severity score suggests a moderate risk level, but the ease of exploitation by low-privilege authenticated users increases the likelihood of exploitation in environments with weak user access controls.

1. Monitor the WP Table Builder plugin vendor announcements closely and apply security patches immediately once available. 2. Until a patch is released, restrict Subscriber-level user capabilities by customizing WordPress roles and permissions to prevent unauthorized table creation. 3. Implement strict user access controls and audit user roles to ensure only trusted users have Subscriber-level or higher access. 4. Employ web application firewalls (WAFs) with custom rules to detect and block suspicious requests targeting the save_table() function or related endpoints. 5. Regularly audit website content for unauthorized changes, especially new table posts created without administrative approval. 6. Educate site administrators and content managers about this vulnerability and encourage vigilance regarding unusual site behavior. 7. Consider disabling or replacing the WP Table Builder plugin with alternatives that have a stronger security track record if immediate patching is not feasible. 8. Maintain comprehensive backups of website content to enable rapid restoration in case of unauthorized modifications.