The Tablesome Table – Contact Form DB plugin for WordPress is vulnerable to arbitrary file uploads because it lacks file type validation in the set_featured_image_from_external_url() function. This flaw allows unauthenticated users to upload any file to the website’s server, potentially creating a path to remote code execution in environments where unauthenticated users can add featured images through the plugin’s workflow trigger. The weakness is categorized as CWE‑434, reflecting improper file type validation.

WordPress sites using the Tablesome Table – Contact Form DB plugin, including support for WPForms, Contact Form 7, Gravity Forms, Forminator, and Fluent forms, are affected. All releases up to and including version 1.1.32 of the plugin are vulnerable; newer releases are not listed as impacted.

The vulnerability carries a CVSS score of 9.8, indicating critical severity, while the EPSS score is below 1%, suggesting only a low but non‑zero exploitation probability at present. It is not flagged in the CISA KEV catalog. Attackers can exploit the flaw without authentication via a web front‑end endpoint that accepts external image URLs. If the site’s configuration permits unauthenticated users to submit featured image URLs and a workflow trigger is present, the uploaded file could be executed, leading to full remote code execution on the server.