What is the CVSS score of CVE-2026-66659?

CVE-2026-66659 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 29.0%.

Which versions of Tablesome Table are affected by CVE-2026-66659?

Organizations using the Essekia Tablesome Table WordPress plugin versions 1.2.9 or earlier face an immediate data breach risk from a critical SQL injection vulnerability (CVSS 9.3) that allows…

How to fix or mitigate CVE-2026-66659?

Within 24 hours, immediately inventory all WordPress installations using Tablesome Table plugin versions 1.2.9 or earlier and disable the plugin on affected systems; simultaneously review database access logs for suspicious SQL injection patterns. Within 7 days, implement web application firewall (WAF) rules to block SQL injection attack signatures, enforce principle of least privilege on database user accounts, and establish enhanced monitoring on database query activity for anomalous patterns. Within 30 days, evaluate alternative table plugins as permanent replacements, develop a migration plan away from Tablesome Table, subscribe to vendor advisories for patch releases, and conduct a forensic database audit if any suspicious activity was detected during the 7-day monitoring window.

Tablesome Table CVE-2026-66659

EUVD-2026-57109 CRITICAL

SQL Injection (CWE-89)

2026-08-12 Patchstack

GHSA-g685-gm2w-w3m3

WordPress SQLi Wordpress Plugin Tablesome Table

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Remote unauthenticated blind SQLi (AV:N/AC:L/PR:N/UI:N) reaching the shared WordPress database gives S:C and C:H; limited I:L reflects potential DB writes, availability not clearly impacted.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 06:35 vuln.today

CVE Published

Aug 12, 2026 - 06:01 cve.org

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection.

This issue affects Tablesome Table: from n/a through 1.2.9.

AnalysisAI

Blind SQL injection in the Essekia "Tablesome Table" WordPress plugin (versions up to and including 1.2.9) lets remote attackers inject malicious SQL into database queries, enabling inference-based extraction of database contents. The CVSS 3.1 score of 9.3 reflects unauthenticated network exploitability with a scope change (S:C), meaning the impact reaches the underlying WordPress database beyond the plugin itself. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Tablesome Table is a WordPress plugin (CPE cpe:2.3:a:essekia:tablesome_table) used to build and display data tables, often integrating with contact forms and post/table data. The root cause is CWE-89, Improper Neutralization of Special Elements used in an SQL Command: user-supplied input is concatenated into a SQL query without proper parameterization or escaping, allowing an attacker to alter the query structure. Because the flaw is "blind," the application does not return query results directly; the attacker infers data by observing boolean or time-based differences in responses. WordPress plugins typically execute such queries through the shared $wpdb interface, so injection here can touch core WordPress tables (users, options, etc.), consistent with the scope-change (S:C) rating.

RemediationAI

No vendor-released patch version was identified in the provided data; the primary action is to monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/tablesome/vulnerability/wordpress-tablesome-plugin-1-2-9-sql-injection-vulnerability) and the WordPress plugin repository for a release newer than 1.2.9, then upgrade immediately once available. Until a patch is confirmed, consider deactivating and removing the Tablesome plugin, which fully eliminates exposure at the cost of losing table functionality on the site. As compensating controls, deploy a WordPress-aware WAF (such as Patchstack's or Wordfence's virtual patching) to block SQL injection patterns against the plugin's endpoints, restrict access to the affected pages/AJAX handlers where feasible, and enable database query monitoring to detect blind-injection probing (repeated time-based or boolean payloads). WAF rules can produce false positives on legitimate table queries, so tune and test them before enforcing block mode.