CVE-2026-18881 describes a blind SQL Injection vulnerability in the TableOn – WordPress Posts Table Filterable plugin for WordPress, affecting all versions up to and including 1.0.5.1. The issue is due to insufficient escaping and lack of proper preparation of the user-supplied filter_data[comment_count] parameter in the tableon_get_table_data AJAX action. The parameter value is split on ':' and both parts are directly interpolated into the posts_where SQL clause without intval() casting or use of $wpdb->prepare(), enabling unauthenticated attackers to append additional SQL queries. The researcher demonstrated extraction of sensitive data such as the database name, user login names, and password hashes from the wp_users table.

An unauthenticated attacker can exploit this vulnerability to perform blind SQL Injection attacks, allowing extraction of sensitive information from the WordPress database, including user credentials and database details. The vulnerability does not impact integrity or availability directly but compromises confidentiality significantly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the vulnerable AJAX action or restricting access to it as a temporary mitigation. Avoid using affected versions (<=1.0.5.1) in production environments where sensitive data is stored.