CVE-2026-24524: 
WordPress vulnerability analysis and mitigation

CVE-2026-24524 is a Missing Authorization (Broken Access Control) vulnerability in the Essekia Tablesome WordPress plugin that allows low-privileged authenticated attackers to exploit incorrectly configured access control security levels. It was reported by researcher Nabil Irawan on December 27, 2025, and published by Patchstack on January 23, 2026. The vulnerability affects Tablesome versions up to and including 1.2.8, with version 1.2.9 serving as the patched release. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged actions. A low-privileged authenticated user (e.g., a WordPress Subscriber role) can invoke functionality that should be restricted to higher-privileged roles, exploiting the absence of proper nonce token or capability checks. The attack vector is network-based, requires no user interaction, and has low attack complexity. The CVE record was updated multiple times by Patchstack to expand the affected version range from ≤1.1.35.2 to ≤1.2.6 and finally to ≤1.2.8, indicating the flaw persisted across several plugin releases (Patchstack, NVD).

Successful exploitation allows a low-privileged authenticated attacker to perform unauthorized actions within the Tablesome plugin, primarily resulting in unauthorized data modification (integrity impact). Confidentiality and availability are not directly impacted according to the CVSS scoring. While the individual impact is limited, such broken access control flaws in widely deployed WordPress plugins are frequently leveraged in mass-exploit campaigns targeting thousands of sites simultaneously, regardless of site size or popularity (Patchstack).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.017%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that broken access control vulnerabilities of this type are commonly used in mass-exploit campaigns against WordPress sites.

1. Reconnaissance: Identify WordPress sites running the Tablesome plugin version ≤1.2.8 using tools like WPScan or Shodan, or by checking the plugin's readme.txt file exposed at /wp-content/plugins/tablesome/readme.txt.
2. Obtain low-privileged access: Register or obtain credentials for a low-privileged WordPress account (e.g., Subscriber role), which may be available on sites with open registration.
3. Identify unprotected endpoints: Enumerate plugin AJAX actions or REST API endpoints registered by Tablesome that lack proper capability or nonce checks, using browser developer tools or by reviewing plugin source code.
4. Send unauthorized request: Craft and send an authenticated HTTP request (e.g., a POST to wp-admin/admin-ajax.php with the relevant action parameter) to invoke a privileged function without the required authorization check.
5. Achieve unauthorized modification: The server processes the request without validating the user's privilege level, allowing the attacker to modify plugin data or settings beyond their intended access scope (Patchstack).

• Logs: WordPress access logs showing repeated POST requests to wp-admin/admin-ajax.php with Tablesome-specific action parameters from low-privileged user accounts; unexpected plugin configuration changes recorded in WordPress audit logs.
• File System: Unexpected modifications to Tablesome plugin data files or database tables (e.g., tablesome_* tables in the WordPress database) not attributable to administrative actions.
• Network: Unusual authenticated HTTP POST requests to WordPress AJAX or REST endpoints from subscriber-level accounts at high frequency, potentially indicating automated exploitation attempts.

The primary remediation is to update the Tablesome plugin to version 1.2.9 or later, which contains the fix for this vulnerability (Patchstack). If immediate update is not possible, site administrators should disable open user registration to prevent untrusted users from obtaining the low-privileged access required for exploitation, and consult their hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins as an additional protective measure.

The vulnerability was reported by security researcher Nabil Irawan and disclosed through Patchstack's coordinated vulnerability disclosure process. Patchstack classified it as low priority with no impactful threat, noting it is unlikely to be exploited despite the general risk class being associated with mass-exploit campaigns (Patchstack). No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified.