CVE-2025-11499 — AI Deep Analysis Summary

🚨 **Essence**: Critical **Unrestricted File Upload** flaw in Tablesome Table plugin. <br>💥 **Consequences**: Attackers can upload **malicious PHP shells** directly to the server.…

🛡️ **Root Cause**: **CWE-434** (Unrestricted Upload of File with Dangerous Type). <br>🔍 **Flaw**: The function `set_featured_image_from_external_url()` fails to validate file types.…

🏢 **Vendor**: essekia. <br>📦 **Product**: Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent. <br>📉 **Affected Versions**: **1.1.32 and earlier**.…

⚔️ **Attacker Capabilities**: <br>1. Upload **Web Shells** (PHP files). <br>2. Execute arbitrary code on the server. <br>3. Access sensitive **Database Credentials** and user data. <br>4.…

📉 **Exploitation Threshold**: **LOW**. <br>🔓 **Auth**: **Unauthenticated**. No login needed to trigger the upload.…

🔓 **Public Exploits**: **YES**. <br>📂 **PoCs Available**: Multiple GitHub repositories (e.g., Hazelooks, rootreapers) provide ready-to-use Python scripts. <br>🌐 **Wild Exploitation**: High risk.…

🔍 **Self-Check Steps**: <br>1. Check WordPress Plugins list for **Tablesome Table**. <br>2. Verify version is **≤ 1.1.32**. <br>3. Scan for suspicious `.php` files in `wp-content/uploads` directories. <br>4.…

🛠️ **Official Fix**: **YES**. <br>📝 **Patch**: Update the plugin to the latest version. <br>🔗 **Reference**: See WordPress Trac changeset 3386484 for the fix in `wp-post-creation.php`.…

🚧 **No Patch Workaround**: <br>1. **Disable** the Tablesome Table plugin immediately if not essential. <br>2. Restrict file upload permissions via `.htaccess` or server config. <br>3.…

🔥 **Urgency**: **CRITICAL / IMMEDIATE ACTION REQUIRED**. <br>⏳ **Priority**: **P0**. <br>💡 **Reason**: Unauthenticated RCE via file upload is one of the most dangerous vulnerabilities.…