What is the CVSS score of CVE-2026-14924?

CVE-2026-14924 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-14924?

Yes, a public proof-of-concept exploit is available for CVE-2026-14924. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-14924?

Yes, a patch is available for CVE-2026-14924. Update the affected software to the latest version immediately.

Tablesome Table CVE-2026-14924

EUVD-2026-49702 HIGH

Missing Authorization (CWE-862)

2026-07-28 WPScan

GHSA-jc98-p7c8-r93j

WordPress Authentication Bypass Tablesome Table Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 14:41 vuln.today

CVSS changed

Jul 28, 2026 - 14:37 NVD

7.5 (HIGH)

Patch available

Jul 28, 2026 - 07:01 EUVD

CVE Published

Jul 28, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 28, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages.

Articles & Coverage 1

News 19 New WordPress Vulnerabilities - 2 Critical, 17 High Jul 29, 2026

AnalysisAI

Unauthorized post creation and arbitrary post/page overwrite in the Tablesome Table WordPress plugin before version 1.1.31 due to missing authentication, capability, and nonce checks in an AJAX action. Unauthenticated attackers can create new published posts or overwrite any existing published content. Public exploit code exists, but no active exploitation has been confirmed; EPSS predicts very low exploitation probability (0.18%).