CVE-2025-12845: falha de alta gravidade em essekia Tablesome Table – Contact Form DB…
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation
Publicada em
Seguir esta CVE+ Monitorar Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
43Vexday Risk Score
Priorize a correção. Ela exploração observada pelo VulnCheck.
ssvc Actcvss 8.8epss 0.4%
da publicação à arma
Publicada no NVD19 de fev.
VulnCheck19 de fev.
The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access of data that leads to privilege escalation due to a missing capability check on the get_table_data() function in versions 0.5.4 to 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve plugin table data that can expose email log information. Attackers can leverage this on sites where the table log is enabled in order to trigger a password reset and obtain the reset key.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
essekia · Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, FluentCVEs relacionadas — essekia Tablesome Table – Contact Form DB…
No mesmo produto, das mais perigosas para as menos.
CVE-2025-11499CRITICALTablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.1.32 - Unauthenticated Arbitrary File UploadEPSS 1.1%CVE-2022-4974MEDIUMFreemius SDK <= 2.4.2 - Missing Authorization ChecksEPSS 0.4%CVE-2024-13362MEDIUMFreemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url ParameterEPSS 0.3%