The vulnerability is a missing authorization check in the Essekia Tablesome Table Premium plugin. It enables attackers to invoke functionality that is not properly constrained by access control lists, potentially allowing unauthorized reading, modification, or deletion of content and the execution of privileged actions. This missing enforcement falls under CWE‑862, which is a classic broken access control weakness.

Any WordPress site that installs Tablesome Table Premium version 1.1.23 or earlier is affected. The issue is confined to the plugin itself and therefore impacts WordPress installations where the plugin is enabled and has administrative or elevated user roles present.

The CVSS score of 7.5 indicates a moderate‑to‑high severity, while the EPSS score of <1% suggests that exploitation is currently unlikely but not impossible. The flaw is not listed in CISA’s KEV catalog, implying no widely reported active exploitation. The likely attack vector is inferred to be the delivery of crafted HTTP requests to the plugin’s endpoints, which may require an authenticated session or a user with a role that can trigger plugin actions. Since the problem stems from improper enforcement of ACLs, the risk is elevated in environments where plugin permissions are not tightly controlled.