CVE-2025-12845: high-severity vulnerability in essekia Tablesome Table – Contact Form DB…
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation
Published
Follow this CVE+ Monitor Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
43Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck.
ssvc Actcvss 8.8epss 0.4%
from disclosure to weapon
Published on NVDFeb 19
VulnCheckFeb 19
The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access of data that leads to privilege escalation due to a missing capability check on the get_table_data() function in versions 0.5.4 to 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve plugin table data that can expose email log information. Attackers can leverage this on sites where the table log is enabled in order to trigger a password reset and obtain the reset key.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
essekia · Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, FluentRelated CVEs — essekia Tablesome Table – Contact Form DB…
In the same product, most dangerous first.
CVE-2025-11499CRITICALTablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.1.32 - Unauthenticated Arbitrary File UploadEPSS 1.1%CVE-2022-4974MEDIUMFreemius SDK <= 2.4.2 - Missing Authorization ChecksEPSS 0.4%CVE-2024-13362MEDIUMFreemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url ParameterEPSS 0.3%