CVE-2026-111947 Easy Pricing Tables CVE debrief

Who should care

Defenders responsible for WordPress installations with the Pricing Table WordPress Plugin should assess exposure and prioritize updates to prevent exploitation. This includes verifying plugin versions, restricting contributor permissions, and monitoring for suspicious activity to prevent exploitation and minimize potential impact. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability details,

Why it matters

CVE-2026-111947 allows users with contributor+ roles to clone and publish arbitrary posts, including private and draft content, on WordPress sites using the Pricing Table WordPress Plugin version 4.1.3 or earlier. Defenders should verify plugin versions, restrict contributor permissions, and monitor for suspicious activity to prevent exploitation and minimize potential impact.

• Potential unauthorized publication of sensitive content
• Possible disruption of content management workflows
• Risk of contributor role abuse for malicious activities
• Need for verification of plugin version and user role configurations

Technical summary

The Pricing Table WordPress Plugin before version 4.1.3 does not perform authorization checks when duplicating a legacy pricing table. This allows users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to other users. The vulnerability enables unauthorized publication of sensitive content, possible disruption of content management workflows, and risk of contributor role abuse for malicious activities. Defenders should prioritize verifying and updating the Pricing Table WordPress Plugin to version 4.1.3 or later, and restrict contributor role permissions if possible.

Defensive priority

Defenders should prioritize verifying and updating the Pricing Table WordPress Plugin to version 4.1.3 or later, and restrict contributor role permissions if possible.

Recommended defensive actions

• Verify and update the Pricing Table WordPress Plugin to version 4.1.3 or later
• Restrict contributor role permissions to prevent exploitation
• Monitor for suspicious activity related to post cloning and publishing
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD records confirm the vulnerability in the Pricing Table WordPress Plugin. WPScan provides additional details on the vulnerability. The vulnerability allows users with contributor+ roles to clone and publish arbitrary posts, including private and draft content, on WordPress sites using the Pricing Table WordPress Plugin version 4.1.3 or earlier. The CVE Program and NVD records provide source-provided CVE metadata and official vulnerability assessment. The source item details and supplemental source references add

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.