Executive Summary

The vulnerability exists in the Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress, specifically in versions 0.5.4 to 1.2.1. It is caused by a missing capability check on the get_table_data() function, which allows authenticated users with Subscriber-level access or higher to access plugin table data without proper authorization.

This unauthorized access can expose sensitive email log information stored by the plugin. Attackers can exploit this to trigger password resets and obtain reset keys, potentially escalating their privileges on the affected WordPress site.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to serious security impacts including unauthorized disclosure of sensitive email log data.

• Exposure of email log information that may contain personal or sensitive data.
• Privilege escalation by attackers who can use the exposed data to trigger password resets and obtain reset keys.
• Potential full account takeover or unauthorized access to user accounts on the WordPress site.

Overall, this can compromise the confidentiality, integrity, and availability of the affected system.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update the Tablesome Table – Contact Form DB plugin to version 1.2.2 or later, as this version includes multiple code improvements and likely security fixes.

Additionally, restrict Subscriber-level access where possible and disable the table log feature if it is not needed, to reduce the risk of attackers leveraging the vulnerability to obtain password reset keys.

Useful 0 Not Useful 0