Unauthorized Data Access in Tablesome Table Plugin for WordPress
CVE-2025-12845

8.8HIGH

Key Information:

Vendor

WordPress
Status
Tablesome Table – Contact Form Db – WPforms, Cf7, Gravity, Forminator, Fluent
Vendor
CVE Published:
19 February 2026

What is CVE-2025-12845?

The Tablesome Table plugin for WordPress is susceptible to unauthorized data access due to an inadequate capability check on the get_table_data() function. This vulnerability affects versions 0.5.4 to 1.2.1 and allows authenticated attackers with Subscriber-level access or higher to access sensitive plugin table data. This exposure can lead to revealing email logs and may enable attackers to trigger password resets and access reset keys. Proper security measures and updates are essential to mitigate this issue.

Affected Version(s)

Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 <= 1.2.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3447966

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kenneth Dunn
.