Arbitrary File Upload Vulnerability in Tablesome Table Plugin by WordPress
CVE-2025-11499

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Tablesome Table – Contact Form Db – WPforms, Cf7, Gravity, Forminator, Fluent
Vendor
CVE Published:
1 November 2025

What is CVE-2025-11499?

The Tablesome Table plugin for WordPress is susceptible to an arbitrary file upload vulnerability due to insufficient file type validation in the set_featured_image_from_external_url() function. This flaw exists across all versions up to and including 1.1.32, enabling unauthenticated attackers to upload arbitrary files to the server. The vulnerability poses a significant risk, particularly in configurations where unauthenticated users can add featured images, leading to potential remote code execution under exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent * <= 1.1.32

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/tablesome/trun...
https://plugins.trac.wordpress.org/changeset/3386484/tabl...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Talal Nasraddeen
JSON
.