This vulnerability is a missing authorization flaw in the Essekia Tablesome WordPress plugin that permits the exploitation of incorrectly configured access control security levels. An attacker who can invoke the plugin’s functions is able to bypass the intended access restrictions, potentially executing actions that should be limited to privileged users. The result is unauthorized access to the plugin’s data or configuration, which could lead to data disclosure or modification. The weakness corresponds to CWE‑862 – Missing Authorization.

Essekia Tablesome plugin for WordPress, all released versions up to and including 1.2.8.

The CVSS score of 4.3 indicates medium severity. The EPSS score of <1% suggests exploitation is currently unlikely but not impossible. This vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers could exploit the flaw from a remote web session by sending crafted HTTP requests to the plugin’s endpoints that lack proper authorization checks. Once the exploit succeeds, the attacker can perform privileged actions such as reading, editing, or deleting data managed by Tablesome.