CVE-2026-6922 is an incorrect authorization vulnerability in the WP Table Builder – Drag & Drop Table Builder WordPress plugin affecting all versions up to and including 2.2.1. The flaw arises from an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions, which prevents the guard from executing properly. Additionally, the permission callback only verifies plugin role membership without checking per-post-type permissions or ownership. This combination allows authenticated attackers with subscriber-level privileges or higher to trash or restore any post, page, or custom post type by supplying arbitrary post IDs.

An attacker with subscriber-level or higher access can manipulate posts by trashing or restoring any post, page, or custom post type on the affected WordPress site. This can lead to denial of service or disruption of content availability. The vulnerability does not allow direct confidentiality breaches but impacts integrity and availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and monitor for suspicious activity related to post trashing or restoration.