Executive brief
The Tablesome Table plugin for WordPress, which is used to create and manage data tables, contains a security flaw that allows anyone on the internet to modify website content. An attacker can create new unauthorized posts or overwrite existing pages and posts without needing a password. This could lead to website defacement, loss of original content, and unauthorized distribution of information.
Technical details
The Tablesome Table plugin fails to implement authorization checks (CWE-862) and CSRF protection (nonces) within the 'store_tablesome_data' AJAX action. By sending a specially crafted POST request to wp-admin/admin-ajax.php, an unauthenticated remote attacker can trigger the 'add' or 'edit' actions for posts. This allows for the creation of new published posts or the modification of existing post IDs, including core WordPress pages and posts. The vulnerability effectively grants administrative-level content management privileges to any network-based attacker. The issue is resolved in version 1.1.31.
Affected products
- Unknown Tablesome Table < 1.1.31
Timeline
- 2026-07-07: disclosed: Publicly published by WPScan
- 2026-07-28: advisory: NVD published date