What the vulnerability does
01Description
The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image_from_external_url() function in all versions up to, and including, 1.1.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible in configurations where unauthenticated users have been provided with a method for adding featured images, and the workflow trigger is created.
Explanation of Vulnerability in Simple Terms
02Summary
Tablesome Table allows unauthenticated attackers to upload files without restriction, potentially enabling them to store malicious files on the server. The vulnerability affects all versions up to 1.1.32. An attacker can exploit this over the network without authentication or user interaction to upload arbitrary files, which could lead to remote code execution or data compromise depending on server configuration.
What an attacker can do
03Attacker Capabilities
Upload arbitrary files to the server without authentication.
Potential impact on your site
04Site Impact
Attackers can upload malicious files that may execute as code, compromise data, or deface your site.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
November 1, 2025
CVE published
April 8, 2026
Record updated
