CVE-2025-11499

{
  "id": "CVE-2025-11499",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-01T07:15:34.940",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image_from_external_url() function in all versions up to, and including, 1.1.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible in configurations where unauthenticated users have been provided with a method for adding featured images, and the workflow trigger is created."
    },
    {
      "lang": "es",
      "value": "El plugin Tablesome Table - Contact Form DB - WPForms, CF7, Gravity, Forminator, Fluent para WordPress es vulnerable a la carga arbitraria de archivos debido a la falta de validación del tipo de archivo en la función set_featured_image_from_external_url() en todas las versiones hasta la 1.1.32, inclusive. Esto permite a atacantes no autenticados cargar archivos arbitrarios en el servidor del sitio afectado, lo que puede hacer posible la ejecución remota de código en configuraciones donde a los usuarios no autenticados se les ha proporcionado un método para añadir imágenes destacadas y se crea el disparador del flujo de trabajo."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "essekia",
          "product": "Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.1.32",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-03T13:24:09.402901Z",
          "id": "CVE-2025-11499",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://plugins.trac.wordpress.org/browser/tablesome/trunk/workflow-library/actions/wp-post-creation.php#L309",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/changeset/3386484/tablesome/trunk/workflow-library/actions/wp-post-creation.php",
      "source": "[email protected]"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2be770c7-7aa2-430b-981d-5d81fe068bef?source=cve",
      "source": "[email protected]"
    }
  ]
}