CVE-2025-68516: 
WordPress vulnerability analysis and mitigation

CVE-2025-68516 is a Sensitive Data Exposure vulnerability (CWE-201: Insertion of Sensitive Information Into Sent Data) in the Essekia Tablesome WordPress plugin. It allows authenticated users with at least Subscriber-level privileges to retrieve embedded sensitive data that should not be accessible to regular users. All versions up to and including 1.1.35.1 are affected, with version 1.1.35.2 containing the fix. The vulnerability was reported on November 22, 2025, and published on December 22–24, 2025, with a CVSS v3.1 base score of 5.0 (Medium) (Patchstack).

The vulnerability is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin inadvertently includes sensitive data in responses sent to authenticated users. An attacker with a low-privilege Subscriber account can exploit this over the network with low attack complexity and no user interaction required, and the scope is considered changed, indicating impact beyond the vulnerable component. The OWASP Top 10 classification is A3: Sensitive Data Exposure. No public technical write-up or proof-of-concept code has been identified beyond the Patchstack advisory (Patchstack).

Successful exploitation allows a low-privileged authenticated user (Subscriber level) to view sensitive information embedded in plugin responses that is normally restricted. While the confidentiality impact is rated Low and there is no integrity or availability impact, the exposed data could potentially be leveraged to facilitate further attacks against the WordPress site or its users. Patchstack notes this vulnerability type is commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or popularity (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-68516. The EPSS score is approximately 0.031% (0.000310), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with no impactful threat, though it notes that similar vulnerabilities are used in mass-exploit campaigns against WordPress sites (Patchstack).

The vendor has released version 1.1.35.2 of the Tablesome plugin, which resolves this vulnerability. Site administrators should update the Tablesome plugin to version 1.1.35.2 or later immediately via the WordPress admin dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance (Patchstack).

The vulnerability received brief coverage from security news aggregators including TheHackerWire on Mastodon, Bluesky, and Infosec.exchange shortly after disclosure. Wordfence included it in their weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026. No significant vendor statements or notable researcher commentary beyond the Patchstack advisory have been identified (Wordfence).