CVE-2026-4119 is an authorization bypass vulnerability in the Create DB Tables WordPress plugin (up to version 1.2.1). The plugin's admin_post action hooks for adding and deleting tables do not implement capability checks via current_user_can() or nonce verification, relying only on user authentication. Consequently, any logged-in user, regardless of privilege level, can invoke these hooks. The cdbt_delete_db_table() function executes a DROP TABLE SQL query based on user input without authorization checks, enabling deletion of any database table, including critical core tables like wp_users or wp_options. Similarly, cdbt_create_new_table() allows creation of arbitrary tables. This vulnerability can result in destruction or corruption of the WordPress database.

An authenticated attacker with minimal privileges (Subscriber or higher) can delete any database table or create arbitrary tables in the WordPress database. This can lead to loss of critical data, including user accounts and site configuration, potentially rendering the WordPress site inoperable. The CVSS v3.1 score is 9.1 (critical), reflecting the high impact on integrity and availability with no user interaction required and network attack vector.

Patch status is not yet confirmed — no official fix or patch is currently available from the vendor. Until a patch is released, restrict plugin usage to trusted users only or consider disabling the plugin to prevent exploitation. Monitor vendor advisories for updates and apply official fixes once available.