Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.2.14 - Unauthenticated Sensitive Information Exposure via Shared Form Redirect Token
- ID
- WPSEC-2026-1645
- Plugin
- Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent (tablesome)
- Affected
- all versions before 1.2.15
- Remediation
- Update to 1.2.15 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-524
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-25
- Attack surface
- Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent on WPSec AttackSurface
- Fix released
- Published
Description
The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to Sensitive Information Exposure via the get_redirection_data AJAX action in all versions up to, and including, 1.2.14. This is because form redirect data is stored in a transient keyed by a server-generated token. The server sets that token in a cookie and also prints it into the page's script data, so a page cache shares one token among all visitors. This makes it possible for unauthenticated attackers to take the token from the cached page and read, and consume, other visitors' redirect data, which can include submitted form field values added to the redirect URL as parameters. Exploitation requires a page cache that serves the cached cookie along with the page, and a form workflow that uses the Redirection action.
References
- https://wpsec.com/vuln/WPSEC-2026-1645/
- https://plugins.svn.wordpress.org/tablesome/tags/1.2.15/
- https://wordpress.org/plugins/tablesome/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS