CVE-2025-11499: essekia tablesome table – contact form db – wpforms, cf7, gravity, forminator, fluent
Vulnerability summary
CVE-2025-11499 is a critical (CVSS 9.8) vulnerability in essekia tablesome table – contact form db – wpforms, cf7, gravity, forminator, fluent. EPSS estimates a 1.07% chance of exploitation in the next 30 days, higher than 64.3% of scored vulnerabilities. Fixed in 1.3.33.
Timeline
- 01-11-2025PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image_from_external_url() function in all versions up to, and including, 1.1.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible in configurations where unauthenticated users have been provided with a method for adding featured images, and the workflow trigger is created.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.07%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
+0.07 pp
From 1.00% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Essekia1 product
Wordpress1 product
- tablesome≤ 1.1.32 (fixed in 1.3.33)
2 vendors · 2 products