CVE-2025-11499 is a critical vulnerability in the essekia Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent WordPress plugin. The issue arises from the set_featured_image_from_external_url() function lacking proper file type validation, enabling unauthenticated attackers to upload arbitrary files to the server. This arbitrary file upload can potentially lead to remote code execution in environments where unauthenticated users have the ability to add featured images and trigger workflows. The vulnerability affects all versions up to and including 1.1.32. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting high impact on confidentiality, integrity, and availability. No patch or remediation details are currently available from the vendor or advisory sources.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the affected WordPress site server, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability is critical due to the ease of exploitation (network attack vector, no privileges or user interaction required) and the potential for full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict or disable the ability for unauthenticated users to add featured images or interact with the affected plugin's functionality. Monitor for updates from the essekia vendor regarding patches or official mitigations.