Tablesome WordPress Plugin Unauthenticated Arbitrary File Upload Vulnerability

A vulnerability exists in the Tablesome Table WordPress plugin, specifically in the 'Contact Form DB' feature that integrates with WPForms, Contact Form 7, Gravity Forms, Forminator, and Fluent. All versions up to and including 1.1.32 are affected. The issue arises from inadequate file type validation in the 'set_featured_image_from_external_url()' function, allowing unauthenticated users to upload arbitrary files to the server. This could lead to remote code execution, particularly in configurations where unauthenticated users can add featured images and a workflow trigger is active.

Impact

Exploitation of this vulnerability could result in unauthorized file uploads, potentially leading to remote code execution on the affected server.

Remediation

Users are advised to update the Tablesome WordPress plugin to version 1.3.33 or later.