CVE-2025-13753 describes an incorrect authorization vulnerability in the WP Table Builder – Drag & Drop Table Builder WordPress plugin. Specifically, the save_table() function fails to properly verify user permissions, enabling authenticated users with minimal privileges (Subscriber-level and above) to create new table posts. This issue affects all plugin versions up to and including 2.0.19. The vulnerability does not impact confidentiality or availability but allows unauthorized modification of data, reflected in its CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). No patch or vendor advisory is currently available.

An attacker with at least Subscriber-level access to a WordPress site using the vulnerable plugin can create new wptb-table posts without proper authorization. This unauthorized modification of data could lead to content manipulation within the site. There is no impact on confidentiality or availability reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unauthorized content creation related to wptb-table posts. Avoid granting Subscriber-level or higher access to untrusted users. Follow the vendor's updates for any forthcoming patches or official mitigations.