CVE-2025-12845 Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation

🗓️ 19 Feb 2026 03:25:17Reported by WordfenceType

Missing capability check in get_table_data lets Subscriber+ users access email logs and reset keys.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-12845	19 Feb 202620:21	–	circl
CNNVD	WordPress plugin Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 安全漏洞	19 Feb 202600:00	–	cnnvd
CVE	CVE-2025-12845	19 Feb 202603:25	–	cve
NVD	CVE-2025-12845	19 Feb 202607:17	–	nvd
Patchstack	WordPress Tablesome Table 0.5.4-1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation vulnerability	19 Feb 202607:16	–	patchstack
Positive Technologies	PT-2026-20587	19 Feb 202600:00	–	ptsecurity
RedhatCVE	CVE-2025-12845	20 Feb 202607:22	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2025-12845	19 Feb 202600:00	–	vulncheck_kev
Vulnrichment	CVE-2025-12845 Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation	19 Feb 202603:25	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (February 16, 2026 to February 22, 2026)	26 Feb 202616:02	–	wordfence

[
  {
    "vendor": "essekia",
    "product": "Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent",
    "versions": [
      {
        "version": "0.5.4",
        "status": "affected",
        "lessThanOrEqual": "1.2.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/a22b2724-2541-4345-bd42-e8a5844f3f0a
plugins	www.plugins.trac.wordpress.org/changeset/3447966

19 Feb 2026 03:25Current

CVSS 3.18.8

EPSS0.0007

CWE-862