The Table Manager plugin for WordPress versions up to 1.0.0 contains a sensitive information exposure vulnerability (CWE-200) via its 'table_manager' shortcode. The shortcode handler function `tablemanager_render_table_shortcode()` accepts a user-supplied `table` attribute, sanitizes it only with `sanitize_key()`, and concatenates it with the WordPress database prefix to form a table name. It then executes `DESC` and `SELECT *` queries on this table and outputs all data to the frontend. There is no allowlist or verification to ensure the table is one created by the plugin, as the `tablemanager_created_tables` option is only checked in admin functions, not in the shortcode handler. This allows authenticated users with Contributor or higher privileges to extract data from any database table accessible by WordPress, leading to exposure of potentially sensitive information. The vulnerability has a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, and limited confidentiality impact. No known exploits are reported in the wild, and no official patch or remediation level has been published by the vendor as of the data provided.

Authenticated users with Contributor-level or higher privileges can exploit this vulnerability to read data from arbitrary WordPress database tables via the vulnerable shortcode. This leads to unauthorized disclosure of sensitive information stored in the database. The impact is limited to confidentiality loss; integrity and availability are not affected. The vulnerability does not require user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level and higher user privileges to trusted users only. Avoid using the vulnerable shortcode or disable the Table Manager plugin if possible. Monitor for updates from primisdigital regarding a security patch or official mitigation steps.