CVE-2025-12845: fallo de gravedad alta en essekia Tablesome Table – Contact Form DB…
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation
Publicada el
Seguir esta CVE+ Monitorear Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
43Vexday Risk Score
Prioriza la corrección. Ella explotación observada por VulnCheck.
ssvc Actcvss 8.8epss 0.4%
de la publicación al arma
Publicada en NVD19 feb
VulnCheck19 feb
The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access of data that leads to privilege escalation due to a missing capability check on the get_table_data() function in versions 0.5.4 to 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve plugin table data that can expose email log information. Attackers can leverage this on sites where the table log is enabled in order to trigger a password reset and obtain the reset key.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
essekia · Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, FluentCVEs relacionadas — essekia Tablesome Table – Contact Form DB…
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-11499CRITICALTablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.1.32 - Unauthenticated Arbitrary File UploadEPSS 1.1%CVE-2022-4974MEDIUMFreemius SDK <= 2.4.2 - Missing Authorization ChecksEPSS 0.4%CVE-2024-13362MEDIUMFreemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url ParameterEPSS 0.3%