# Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.2.14 - Unauthenticated Sensitive Information Exposure via Shared Form Redirect Token

- **ID:** WPSEC-2026-1645
- **Plugin:** Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent (`tablesome`), https://wordpress.org/plugins/tablesome/
- **Affected versions:** all versions before 1.2.15
- **Fixed in:** 1.2.15 (Update to 1.2.15 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-524
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/tablesome
- **Fix released:** 2026-10-24
- **Published:** 2026-10-25
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1645/

## Description

The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to Sensitive Information Exposure via the get_redirection_data AJAX action in all versions up to, and including, 1.2.14. This is because form redirect data is stored in a transient keyed by a server-generated token. The server sets that token in a cookie and also prints it into the page's script data, so a page cache shares one token among all visitors. This makes it possible for unauthenticated attackers to take the token from the cached page and read, and consume, other visitors' redirect data, which can include submitted form field values added to the redirect URL as parameters. Exploitation requires a page cache that serves the cached cookie along with the page, and a form workflow that uses the Redirection action.

## References

- https://wpsec.com/vuln/WPSEC-2026-1645/
- https://plugins.svn.wordpress.org/tablesome/tags/1.2.15/
- https://wordpress.org/plugins/tablesome/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1645/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.