Data Tables Generator by Supsystic: Unauthenticated table content disclosure via IDOR
Summary
The Data Tables Generator by Supsystic WordPress plugin does not check authorization or ownership when returning the stored contents of a table by its identifier. The only gate is a nonce that is visible to every anonymous visitor. An unauthenticated attacker can read the full contents of any table, including tables that were never published on the site.
Affected
- Data Tables Generator by Supsystic WordPress plugin, all versions before 1.15.8 (according to the CNA record; VulDB lists up to 1.15.7)
Fixed in
- Version 1.15.8
Workaround
- No vendor workaround known.
- Unpublishing or hiding tables does not help, because unpublished tables are also exposed.
Exploitation
- Not listed in CISA KEV.
- No public proof-of-concept found as of 10 Nov 2026; absence of evidence is not proof of safety.
- No attacks observed according to OffSeq honeypot sensors.
- CISA SSVC: automatable yes, technical impact partial.
Our recommendation
- Identify all WordPress sites running the plugin and record their versions.
- Update to version 1.15.8 or later as a first step, then check the vendor release notes.
- Review which sensitive data the affected tables contain and assume it may have been read.
- Review web server and WordPress access logs for unusual requests to the plugin's endpoints.
- Check any Supsystic Pro installations for the reported supply-chain compromise, separately from this CVE.
- Recheck the severity once the WPScan advisory and an NVD score are available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory wpscan.com
- CVE Record www.cve.org
- VulDB entry 435645 vuldb.com
- OpenCVE entry app.opencve.io
- OffSeq Threat Radar radar.offseq.com
- Wordfence threat intel (earlier missing authorization issue) www.wordfence.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:08.
Original description (NVD)
The Data Tables Generator by Supsystic WordPress plugin before 1.15.8 does not perform any authorization or ownership check before returning the stored contents of a table, relying only on a nonce that is exposed to every anonymous visitor, allowing unauthenticated users to read the full contents of any table by its identifier, including tables that are never published anywhere on the site.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.