A vulnerability in the Tablesome WordPress plugin allows authenticated attackers to perform unauthorized data access and privilege escalation, posing a high risk to administrative security.

The vulnerability is caused by a missing authorization check (CWE-862) within the get_table_data function. This flaw permits authenticated users with Subscriber-level privileges or higher to access restricted plugin table data, which can lead to email log exposure and subsequent password reset exploitation.

The vulnerability carries a CVSS score of 8.8, indicating a high severity risk. Successful exploitation could allow a low-privileged user to gain administrative control over the WordPress site by obtaining password reset keys, leading to total compromise of the application, data theft, and potential loss of site integrity.

Immediate Action: Update the Tablesome plugin to the version containing the security fix (referenced in the plugin changelog as the version following 1.2.1).

Proactive Monitoring: Monitor site access logs for unusual requests directed at the get_table_data function or unexpected password reset activity originating from Subscriber accounts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block unauthorized access attempts to the plugin's internal functions if an immediate update is not feasible.

Public Exploit Available: No

Given the potential for full site compromise and the ease with which authenticated users can trigger this vulnerability, administrators should prioritize updating the Tablesome plugin immediately. If an update cannot be performed, restrict plugin access or disable the affected table logging feature until the patch is applied to mitigate the risk of privilege escalation.