{"id":"CVE-2026-14924","state":"PUBLISHED","title":"Tablesome < 1.1.31 - Unauthenticated Post Creation and Modification","description":"The Tablesome Table  WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages.","publishedAt":"2026-07-28T06:00:02.497Z","updatedAt":"2026-07-28T13:16:39.290Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown Tablesome Table"],"affected":[{"vendor":"Unknown","product":"Tablesome Table","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.1.31","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/6cbb9796-5f9b-44b4-b814-176ed225b184/"],"weaknesses":["CWE-862"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/14xxx/CVE-2026-14924.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-14924","state":"PUBLISHED","datePublished":"2026-07-28T06:00:02.497Z","dateUpdated":"2026-07-28T13:16:39.290Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-07-07T09:00:38.166Z"},"containers":{"cna":{"title":"Tablesome < 1.1.31 - Unauthenticated Post Creation and Modification","descriptions":[{"lang":"en","value":"The Tablesome Table  WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages."}],"affected":[{"vendor":"Unknown","product":"Tablesome Table","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.1.31","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/6cbb9796-5f9b-44b4-b814-176ed225b184/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-07-28T06:00:02.497Z"},"credits":[{"lang":"en","value":"Kim Dvash","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-07-28T13:15:35.625281Z","id":"CVE-2026-14924","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","type":"CWE","lang":"en","description":"CWE-862 Missing Authorization"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-28T13:16:39.290Z"}}]}}}