External risk intelligence

Tablesome WordPress Plugin Arbitrary File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-11499

This vulnerability exists in a WordPress plugin used for contact forms and data management. Such plugins are commonly deployed on internet-facing websites to handle user interactions and submissions. While arbitrary file upload requires specific plugin configurations to be triggered, these components are frequently exposed as part of public-facing web applications.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE affects a WordPress plugin, potentially exposing sites to unauthorized file uploads that could lead to code execution. The primary concern is to confirm if this plugin is in use and if the specific configuration exists for this vulnerability to be exploited.

Unauthenticated attackers can upload files to the server.
This could enable remote code execution on your website.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could upload arbitrary files to a WordPress site by exploiting a weakness in a contact form plugin. This is possible because the plugin does not properly check the type of files being uploaded, allowing an attacker to potentially upload malicious files that could lead to the execution of code on the server, especially if the site is configured to allow unauthenticated users to add featured images.

No prior access needed.
Uploading a malicious file triggers it.
Server compromise and code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution when specific configurations are met, such as when unauthenticated users can add featured images and a workflow trigger is active.

Arbitrary files on the server.
Unauthenticated arbitrary file upload.
Potential remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin, if configured to allow unauthenticated users to add featured images, poses a critical risk of arbitrary file uploads and potential remote code execution. Application owners, in coordination with infrastructure and security teams, should first identify all instances of this plugin, determine their reachability and business criticality, and confirm accountable ownership. A risk-based remediation plan should then be developed, prioritizing critical and externally accessible deployments.

App owners and security teams must act.
Verify plugin reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Tablesome WordPress plugin?

Tablesome is a WordPress plugin designed to collect and manage data from various contact forms like WPForms, Contact Form 7, Gravity Forms, Forminator, and Fluent Forms. Users employ it to organize form entries into tables or to automate workflows, such as automatically creating posts or images based on incoming form data.

What does CWE-434 mean regarding CVE-2025-11499?

CWE-434 refers to Unrestricted Upload of File with Dangerous Type. In this CVE, the plugin fails to check the file extension or content of files being uploaded through the set_featured_image_from_external_url() function. This means the server accepts files it should reject, potentially allowing attackers to save malicious scripts directly onto the website's file system.

How is this file upload vulnerability triggered?

An attacker triggers this by interacting with the vulnerable plugin function to upload a file. Crucially, the vulnerability does not trigger unless the site is specifically configured to allow unauthenticated users to trigger the workflow that adds a featured image. If your site does not allow users to perform this action, the specific path for this exploit remains inactive.

Is my website at risk from this CVE?

Halo Surface Signal indicates that because this plugin is typically used for public-facing contact forms, it is frequently exposed to the internet. If your site runs an affected version (1.1.32 or older) and has the specific feature enabled allowing unauthenticated users to create featured images via workflows, your site is at higher risk of being targeted by remote attackers.

What steps should I take if I use Tablesome?

Start by identifying all websites in your environment that have the Tablesome plugin installed and active. Determine if you are using the specific workflow feature that processes external URLs for featured images. If this functionality is in use, prioritize updating the plugin to a patched version or disabling the problematic feature until an update can be applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.