Essekia Tablesome tablesome contains a missing authorization flaw that allows an attacker to exploit incorrectly configured access control security levels. The vulnerability enables unauthorized users to access or manipulate tables within the plugin, potentially leading to disclosure or modification of sensitive data stored in WordPress. The primary impact is loss of data confidentiality and integrity, with the possibility of disrupting normal plugin operations.

The flaw affects Essekia Tablesome plugin versions up to and including 1.1.34; all installations running these or earlier revisions are impacted. The vulnerability is present in the core plugin code and does not require additional components.

The CVSS score of 4.3 indicates low severity, and the EPSS score of < 1% suggests a very low probability of exploitation at this time. It is not listed in CISA's KEV catalog. The likely attack vector is remote, via the WordPress web interface, targeting any authenticated or even unauthenticated user depending on the plugin’s exposure. Exploitation requires that the attacker can reach the plugin’s endpoints, and no additional software or system privileges are required beyond those needed to access the WordPress site.