Tablesome Table CVE-2026-66659

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special conditions - remote unauthenticated exploitation over the network against installations of the Tablesome Table plugin, with no user interaction required. The concrete prerequisite is simply that a target WordPress site has the Tablesome/Tablesome Table plugin installed and active at version 1.2.9 or earlier, with the vulnerable request handler reachable over HTTP(S). The main limiting factor is that exploitation is blind (inference-based), so extracting large volumes of data is slower and noisier than in-band SQLi, and the specific vulnerable parameter/endpoint must be reachable; per the provided data impact is confidentiality-focused (C:H) with no confirmed integrity impact (I:N).

The signals are strong on paper but incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial remote, unauthenticated, low-complexity exploitation with no user interaction, and the 9.3 score is driven up by S:C (scope change) plus C:H, with only limited availability impact (A:L) and no integrity impact (I:N) - an unusual profile for SQLi, where write/integrity impact is often expected but here appears read-oriented (blind data exfiltration). No EPSS score, KEV entry, or POC was provided, so exploitation probability cannot be quantified from the input; the only source is a single Patchstack advisory. The lack of KEV/POC data suggests this is not yet known to be actively exploited, but blind SQLi in a network-reachable WordPress plugin is highly automatable and historically becomes a mass-scanning target once details or a fix diff are public, so it should be treated as a real, near-term priority rather than a theoretical high-CVSS issue. Note the I:N/A:L rating conflicts with the typical assumption that SQLi permits data modification - verify with the vendor whether write access is genuinely constrained.

An unauthenticated attacker identifies a WordPress site running Tablesome Table ≤1.2.9 and sends crafted HTTP requests to a vulnerable plugin parameter, embedding boolean- or time-based SQL payloads. By measuring differences in response content or latency, the attacker iteratively extracts sensitive database contents such as administrator password hashes or secret keys. No public exploit is identified at time of analysis, but the low attack complexity makes automated mass exploitation straightforward.