The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages.
PUBLISHED5.2
Tablesome < 1.1.31 - Unauthenticated Post Creation and Modification
Problem type
- CWE-862 Missing Authorization
Affected products
Unknown
Tablesome Table
< 1.1.31 - AFFECTED
References
GitHub Security Advisories
GHSA-jc98-p7c8-r93j
The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication,...
https://github.com/advisories/GHSA-jc98-p7c8-r93jThe Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages.
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-14924Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-14924",
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"dateUpdated": "2026-07-28T13:16:39.290Z",
"dateReserved": "2026-07-07T09:00:38.166Z",
"datePublished": "2026-07-28T06:00:02.497Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan",
"dateUpdated": "2026-07-28T06:00:02.497Z"
},
"title": "Tablesome < 1.1.31 - Unauthenticated Post Creation and Modification",
"descriptions": [
{
"lang": "en",
"value": "The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages."
}
],
"affected": [
{
"vendor": "Unknown",
"product": "Tablesome Table",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "1.1.31"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-862 Missing Authorization",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/6cbb9796-5f9b-44b4-b814-176ed225b184/",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
]
}
],
"credits": [
{
"lang": "en",
"value": "Kim Dvash",
"type": "finder"
},
{
"lang": "en",
"value": "WPScan",
"type": "coordinator"
}
]
},
"adp": [
{
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-07-28T13:16:39.290Z"
},
"title": "CISA ADP Vulnrichment",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-862 Missing Authorization",
"cweId": "CWE-862",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH"
}
},
{}
]
}
]
}
}