Arbitrary File Upload Vulnerability in Tablesome Table Plugin by WordPress
CVE-2025-11499
9.8CRITICAL
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 1 November 2025
What is CVE-2025-11499?
The Tablesome Table plugin for WordPress is susceptible to an arbitrary file upload vulnerability due to insufficient file type validation in the set_featured_image_from_external_url() function. This flaw exists across all versions up to and including 1.1.32, enabling unauthenticated attackers to upload arbitrary files to the server. The vulnerability poses a significant risk, particularly in configurations where unauthenticated users can add featured images, leading to potential remote code execution under exploitation.
Affected Version(s)
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent * <= 1.1.32