CVE-2026-18881 is a pre-authentication SQL injection in the TableOn WordPress plugin. The vulnerability lives in the tableon_get_table_data AJAX handler, which accepts a user-supplied value from filter_data[comment_count], splits it on the colon character, and interpolates both resulting fragments directly into a posts_where SQL clause. There is no parameterized query, no type casting, and no sanitization applied to either fragment.
The developer's mental model appears to have been that splitting the input on : somehow provides protection — perhaps treating the format as operator:value (like gt:5). This is a critical misconception. String transformation is not sanitization. The split operation does nothing to neutralize SQL metacharacters in either piece. The second fragment was likely intended to be an integer, so no explicit intval() was applied, yet nothing enforces that contract.
The blast radius here is severe. Because the plugin hooks into WordPress's posts_where filter, the injected SQL appends to queries that WordPress executes against every post in the database — not just posts managed by TableOn, but all post types, pages, and custom post types registered by any plugin on the site. In typical shared-hosting deployments where $wpdb runs as a database user with access to multiple databases, this vulnerability can potentially reach beyond the target site's data into other databases on the same MySQL instance.
The CVSS 7.5 is misleading. An unauthenticated attacker with no special conditions required — just an HTTP request to the AJAX endpoint — can extract arbitrary data from the database, including user credentials. This is not a medium-severity issue. The EPSS score of 0.00376 reflects the fact that automated scanners struggle with this injection shape (the payload is fragmented across two interpolation points), so exploitation doesn't show up in the automated exploitation data that EPSS feeds on. This does not mean the vulnerability is less severe in practice — it means attackers would find it through targeted recon rather than mass scanning, which is actually more dangerous for sites running this plugin.
To assess exposure: verify whether the TableOn plugin is installed and check the version. The vulnerability exists through version 1.0.5.1. If the plugin is active, disable it or apply any available update immediately. The correct fix involves applying intval() to the second fragment (the numeric argument) and wrapping the operator comparison in $wpdb->prepare(). Two lines of code eliminate the entire vulnerability — but that triviality is precisely what makes this failure so damning: the fix has existed in WordPress for over a decade, and the plugin has apparently been distributed without either being caught in review or corrected in any update.