CVE-2025-11499

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11499", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-08T14:03:51.516Z", "datePublished": "2025-11-01T06:40:37.314Z", "dateUpdated": "2026-04-08T16:43:46.110Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:46.110Z"}, "affected": [{"vendor": "essekia", "product": "Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.32", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image_from_external_url() function in all versions up to, and including, 1.1.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible in configurations where unauthenticated users have been provided with a method for adding featured images, and the workflow trigger is created."}], "title": "Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent <= 1.1.32 - Unauthenticated Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2be770c7-7aa2-430b-981d-5d81fe068bef?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/tablesome/trunk/workflow-library/actions/wp-post-creation.php#L309"}, {"url": "https://plugins.trac.wordpress.org/changeset/3386484/tablesome/trunk/workflow-library/actions/wp-post-creation.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Talal Nasraddeen"}], "timeline": [{"time": "2025-10-31T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-03T13:24:09.402901Z", "id": "CVE-2025-11499", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T13:30:46.874Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11499", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-03T13:24:09.402901Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T13:24:10.193Z"}}], "cna": {"title": "Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent <= 1.1.32 - Unauthenticated Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Talal Nasraddeen"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "essekia", "product": "Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.32"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-31T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2be770c7-7aa2-430b-981d-5d81fe068bef?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/tablesome/trunk/workflow-library/actions/wp-post-creation.php#L309"}, {"url": "https://plugins.trac.wordpress.org/changeset/3386484/tablesome/trunk/workflow-library/actions/wp-post-creation.php"}], "descriptions": [{"lang": "en", "value": "The Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image_from_external_url() function in all versions up to, and including, 1.1.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible in configurations where unauthenticated users have been provided with a method for adding featured images, and the workflow trigger is created."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:46.110Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11499", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:43:46.110Z", "dateReserved": "2025-10-08T14:03:51.516Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-01T06:40:37.314Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent", "vendor": "essekia", "versions": [{"lessThanOrEqual": "1.1.32", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image_from_external_url() function in all versions up to, and including, 1.1.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible in configurations where unauthenticated users have been provided with a method for adding featured images, and the workflow trigger is created."}, {"lang": "es", "value": "El plugin Tablesome Table - Contact Form DB - WPForms, CF7, Gravity, Forminator, Fluent para WordPress es vulnerable a la carga arbitraria de archivos debido a la falta de validaci\u00f3n del tipo de archivo en la funci\u00f3n set_featured_image_from_external_url() en todas las versiones hasta la 1.1.32, inclusive. Esto permite a atacantes no autenticados cargar archivos arbitrarios en el servidor del sitio afectado, lo que puede hacer posible la ejecuci\u00f3n remota de c\u00f3digo en configuraciones donde a los usuarios no autenticados se les ha proporcionado un m\u00e9todo para a\u00f1adir im\u00e1genes destacadas y se crea el disparador del flujo de trabajo."}], "id": "CVE-2025-11499", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11499", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-03T13:24:09.402901Z", "version": "2.0.3"}}]}, "published": "2025-11-01T07:15:34.940", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/tablesome/trunk/workflow-library/actions/wp-post-creation.php#L309"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3386484/tablesome/trunk/workflow-library/actions/wp-post-creation.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2be770c7-7aa2-430b-981d-5d81fe068bef?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T21:50:08.776218+00:00", "value": {"mitigation_remediation": ["Update the Tablesome Table \u2013 Contact Form DB plugin to a version newer than 1.1.32 that includes the file type validation fix.", "If a patch is not yet available, restrict the set_featured_image_from_external_url endpoint so that only authenticated users can invoke it, thereby blocking unauthenticated uploads.", "Reconfigure the web server so that any files uploaded via this plugin cannot be executed\u2014move the upload directory outside the web root or set the directory\u2019s permissions to non\u2011executable and disable script execution in that directory."], "summary": {"action": "Patch Now", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "WordPress sites using the Tablesome Table \u2013 Contact Form DB plugin, including support for WPForms, Contact Form 7, Gravity Forms, Forminator, and Fluent forms, are affected. All releases up to and including version 1.1.32 of the plugin are vulnerable; newer releases are not listed as impacted.", "description_and_impact": "The Tablesome Table \u2013 Contact Form DB plugin for WordPress is vulnerable to arbitrary file uploads because it lacks file type validation in the set_featured_image_from_external_url() function. This flaw allows unauthenticated users to upload any file to the website\u2019s server, potentially creating a path to remote code execution in environments where unauthenticated users can add featured images through the plugin\u2019s workflow trigger. The weakness is categorized as CWE\u2011434, reflecting improper file type validation.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 9.8, indicating critical severity, while the EPSS score is below 1%, suggesting only a low but non\u2011zero exploitation probability at present. It is not flagged in the CISA KEV catalog. Attackers can exploit the flaw without authentication via a web front\u2011end endpoint that accepts external image URLs. If the site\u2019s configuration permits unauthenticated users to submit featured image URLs and a workflow trigger is present, the uploaded file could be executed, leading to full remote code execution on the server."}}}}, "created": "2025-11-03T10:43:37.002700+00:00", "updated": "2026-04-22T22:00:18.074369+00:00", "vendors": ["essekia", "essekia$PRODUCT$tablesome_table", "wordpress", "wordpress$PRODUCT$wordpress"]}