Tablesome permits unauthenticated creation and overwrite of published content
Tablesome before 1.1.31 exposes an AJAX operation without authentication, a capability check or nonce validation. An unauthenticated attacker can submit content that reaches the plugin's post-creation or update operation, create new published posts, or overwrite arbitrary existing posts and pages. The WPScan CNA record does not disclose the AJAX action, request parameters or vulnerable function, so those mechanics remain unknown.
- Component
- Tablesome Table
- Plugin slug
tablesome-table- Affected
- < 1.1.31
- Safe version
1.1.31- Published
- Jul 28, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Jul 28, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update Tablesome to 1.1.31 or later. Review recently created and modified posts and pages for unexplained changes, including revisions that may preserve attacker-supplied content.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N