CVE-2025-11499: Tablesome WordPress Plugin RCE Vulnerability

CVE-2025-11499 Overview

CVE-2025-11499 is a critical arbitrary file upload vulnerability affecting the Tablesome Table – Contact Form DB plugin for WordPress. The vulnerability exists in the set_featured_image_from_external_url() function due to missing file type validation in all versions up to and including 1.1.32. This security flaw enables unauthenticated attackers to upload arbitrary files to the affected WordPress site's server, potentially leading to remote code execution.

The vulnerability is particularly dangerous in configurations where unauthenticated users have been provided with a method for adding featured images and when the workflow trigger is created. Successful exploitation could allow attackers to gain complete control over the affected WordPress installation.

Critical Impact
Unauthenticated attackers can upload malicious files including PHP web shells, potentially achieving full remote code execution on vulnerable WordPress sites.

Affected Products

Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress versions up to and including 1.1.32

Discovery Timeline

2025-11-01 - CVE-2025-11499 published to NVD
2025-11-04 - Last updated in NVD database

Technical Details for CVE-2025-11499

Vulnerability Analysis

This arbitrary file upload vulnerability (CWE-434) stems from inadequate security controls in the Tablesome plugin's post creation workflow functionality. The set_featured_image_from_external_url() function, located in the wp-post-creation.php file, accepts external URLs for featured images without properly validating the file type being uploaded to the server.

The function fails to implement essential security measures such as file extension whitelisting, MIME type verification, or content inspection. This allows an attacker to craft a malicious request that uploads arbitrary file types, including executable PHP scripts, to the WordPress uploads directory.

Root Cause

The root cause is missing file type validation in the set_featured_image_from_external_url() function within the plugin's workflow library. When processing external URLs for featured images, the function retrieves and stores files without verifying that the content is actually an image file. This absence of input validation creates a direct path for uploading malicious payloads.

The vulnerability is exposed through the plugin's workflow automation features, specifically the post creation actions that allow setting featured images from external sources. Without proper authentication checks combined with the missing file validation, unauthenticated users can exploit this functionality.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

Identifying a WordPress site running a vulnerable version of the Tablesome plugin
Crafting a request that triggers the workflow action for setting a featured image from an external URL
Pointing the external URL to a malicious PHP file hosted on an attacker-controlled server
The plugin downloads and stores the malicious file in the WordPress uploads directory
The attacker then accesses the uploaded file directly to execute arbitrary code

The vulnerability mechanism involves the plugin's external URL handling for featured images. Technical details and the specific code changes can be reviewed in the WordPress Plugin Changeset 3386484. The vulnerable code path is documented in the WordPress Plugin Code Review.

Detection Methods for CVE-2025-11499

Indicators of Compromise

Unexpected PHP files or web shells appearing in the WordPress uploads directory (wp-content/uploads/)
Suspicious outbound network connections originating from the web server
Unusual file creation events in WordPress media directories with non-image extensions
Web server access logs showing requests to unfamiliar PHP files in upload directories

Detection Strategies

Monitor WordPress uploads directories for newly created files with executable extensions (.php, .phtml, .php5)
Implement file integrity monitoring on WordPress installations to detect unauthorized file additions
Review web server access logs for POST requests to Tablesome plugin endpoints followed by requests to files in upload directories
Deploy web application firewall (WAF) rules to detect and block arbitrary file upload attempts

Monitoring Recommendations

Enable detailed logging for the WordPress uploads directory and monitor for file creation events
Configure alerts for any PHP file uploads to media directories
Monitor outbound connections from web servers for potential command and control activity
Regularly audit installed plugin versions and compare against known vulnerable versions

How to Mitigate CVE-2025-11499

Immediate Actions Required

Update the Tablesome Table plugin to a version newer than 1.1.32 immediately
Review WordPress uploads directories for any suspicious or unexpected files
Temporarily disable the Tablesome plugin if immediate patching is not possible
Implement file upload restrictions at the web server level as an additional defense layer

Patch Information

The vulnerability has been addressed in the Tablesome plugin. The patch introduces proper file type validation in the set_featured_image_from_external_url() function. Detailed information about the fix can be found in the WordPress Plugin Changeset 3386484.

Additional vulnerability analysis is available from Wordfence Vulnerability Analysis.

Workarounds

Disable the Tablesome plugin until it can be updated to a patched version
Remove or restrict access to the workflow feature that allows setting featured images from external URLs
Implement server-level restrictions to prevent PHP execution in the WordPress uploads directory
Use a web application firewall to block requests containing executable file extensions to plugin endpoints

bash

# Disable PHP execution in WordPress uploads directory (Apache)
# Add to .htaccess in wp-content/uploads/
<Files "*.php">
    Order Deny,Allow
    Deny from all
</Files>