An unauthenticated arbitrary file upload vulnerability in the Tablesome Table plugin for WordPress exposes affected sites to potential remote code execution.

This vulnerability is caused by missing file type validation in the set_featured_image_from_external_url function. Unauthenticated attackers can leverage this flaw to upload malicious files to the server, which may lead to remote code execution if specific workflow triggers are enabled.

The severity of this vulnerability is critical, reflected by a CVSS score of 9.8. Successful exploitation allows an attacker to achieve remote code execution, granting them full control over the affected web server. This poses an extreme risk of data breach, unauthorized system access, and complete service disruption, potentially leading to significant reputational and operational damage.

Immediate Action: Update the Tablesome Table plugin to the latest version, ensuring all instances are patched beyond version 1.1.32.

Proactive Monitoring: Monitor server access logs for suspicious file upload requests or unauthorized attempts to access files within the plugin upload directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file upload requests that do not strictly adhere to expected file types or extensions.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub (Hazelooks/CVE-2025-11499-Exploit).

Given the critical nature of this vulnerability and the availability of proof-of-concept code, administrators should treat this as an urgent security matter. Prioritize the update of the Tablesome Table plugin across all production environments immediately to prevent potential compromise. If an update is not immediately feasible, consider disabling the affected plugin or implementing robust WAF filtering to restrict unauthorized file uploads until the patch is applied.