Introduction
Attackers can upload arbitrary files to vulnerable WordPress sites running the Tablesome Table plugin, and may gain remote code execution if the server is misconfigured. The issue affects thousands of sites and is trivial to exploit in certain configurations. Any organization using this plugin should treat it as a high-priority risk.
Tablesome Table is a moderately popular WordPress plugin by essekia, with over 228,000 downloads and about 9,000 active installations. It lets users build responsive tables and manage contact form submissions. Its broad feature set and integrations with popular form plugins have made it a common choice for WordPress site administrators.
Technical Information
The vulnerability is in the set_featured_image_from_external_url() function in the plugin's workflow library (wp-post-creation.php, line 309). The function handles featured image uploads from external URLs as part of the plugin's workflow automation system, and it lacks adequate server-side file type validation. When a workflow lets unauthenticated users submit featured images, the plugin does not check that the uploaded file is a real image. Attackers can therefore upload files with dangerous extensions such as .php, which the server may execute if the upload directory allows it.
The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). Attackers can exploit it by sending crafted HTTP requests that submit malicious files through the vulnerable workflow. The risk is highest where a workflow accepts featured images from unauthenticated users and the web server executes PHP files in the upload directory. No public code snippets are available, but the plugin's source and the advisory references document the vulnerable function and the file it lives in.
Affected Systems and Versions
- Product: Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress
- Affected versions: All versions up to and including 1.1.32
- Vulnerable configurations: Sites where workflows allow unauthenticated users to upload featured images and where the server executes PHP files in the upload directory
Vendor Security History
Tablesome Table has a notable history of security issues. Earlier vulnerabilities include:
- CVE-2024-37498 (sensitive data exposure via API, up to 1.0.33)
- CVE-2024-31388 (cross-site request forgery, up to 1.0.25)
- CVE-2024-29110 (reflected cross-site scripting, up to 1.0.27)
The developer has patched each of these, but the repeated input validation and authorization problems indicate ongoing trouble with secure development practices.
