This vulnerability in the Essekia Tablesome WordPress plugin (versions up to 1.2.6) stems from missing authorization checks. An attacker who can invoke the plugin’s functions is able to bypass the intended access restrictions, potentially executing actions that should be limited to privileged users. The result is unauthorized access to the plugin’s data or configuration, which could lead to data disclosure or modification. The weakness corresponds to CWE‑862 – Missing Authorization.

Essekia Tablesome plugin for WordPress, all released versions up to and including 1.2.6.

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1 % suggests that exploitation is currently unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog, meaning no confirmed exploitation has been reported during reconnaissance. Attackers could exploit the flaw from a remote web session by sending crafted HTTP requests to the plugin’s endpoints that lack proper authorization checks. Once the exploit succeeds, the attacker can perform privileged actions such as reading, editing, or deleting data managed by Tablesome.