Research Plan: CVE-2025-12845 Tablesome Privilege Escalation

1. Vulnerability Summary

The Tablesome Table plugin (versions 0.5.4 - 1.2.1) contains a missing authorization vulnerability in the get_table_data() function. While the function is intended for administrative use to retrieve and display table records, it lacks a current_user_can() check. This allows any authenticated user (including Subscriber-level accounts) to retrieve the contents of any "Tablesome Table."

Because this plugin is often used to log contact form submissions and, in some configurations, system emails, an attacker can access sensitive information. Specifically, if the plugin is configured to log outgoing WordPress emails, an attacker can trigger a password reset for an administrator and then read the reset key/link directly from the logged table data, leading to full site takeover.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: tablesome_get_table_data (inferred from function name) or tablesome_table_load_data.
• Method: POST
• Parameters:
  • action: tablesome_get_table_data (inferred)
  • table_id: The ID of the table to leak.
  • nonce: A valid security nonce (usually required for AJAX even if authorization is missing).
• Authentication: Subscriber-level account required.
• Precondition: A Tablesome table must exist that stores sensitive data (e.g., a "Form Submission" log or "Email Log").

3. Code Flow (Inferred)

1. Entry Point: The plugin registers an AJAX action for logged-in users:
   add_action( 'wp_ajax_tablesome_get_table_data', 'get_table_data' );
2. Vulnerable Function: Inside includes/tablesome-functions.php (or similar), the get_table_data() function is defined.
3. Missing Check: The function likely verifies a nonce using check_ajax_referer() but fails to verify if the user has manage_options or similar administrative capabilities.
4. Data Sink: The function proceeds to query the database for records associated with the provided table_id and returns them as a JSON response to the subscriber.

4. Nonce Acquisition Strategy

The Tablesome plugin typically enqueues its assets and nonces for logged-in users who can access the table editor or dashboard. Since the vulnerability is "Subscriber+", we can assume the nonce is available in the admin dashboard for these users.

1. Create/Identify Page: Tablesome usually localizes a nonce in the WordPress admin area.
2. Access Admin: Login as a Subscriber and navigate to /wp-admin/.
3. Extract Nonce:
   • The plugin likely uses wp_localize_script.
   • The global JS object is often tablesome_obj or tablesome_vars.
   • Action: Use browser_eval to extract the nonce.
   • Target: window.tablesome_obj?.nonce or window.tablesome_vars?.ajax_nonce.

5. Exploitation Strategy

Step 1: Data Discovery (Table ID)

First, the attacker needs to find the ID of the table containing logs.

1. Authenticate as a Subscriber.
2. Use the http_request tool to check for existing tables if an endpoint like tablesome_get_tables is also exposed, or simply brute-force small integer IDs (1, 2, 3...) for table_id.

Step 2: Trigger Password Reset

1. Request a password reset for the admin user via /wp-login.php?action=lostpassword.
2. This sends an email containing the reset link.

Step 3: Leak the Reset Key

1. Perform the AJAX request to leak table data.
2. Request:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   
   action=tablesome_get_table_data&table_id=1&nonce=[EXTRACTED_NONCE]
   

3. Response: A JSON object containing rows of table data.
4. Search the response for the text "password reset" or "wp-login.php?action=rp&key=".

Step 4: Privilege Escalation

1. Use the leaked key to set a new password for the admin.
2. Log in as the administrator.

6. Test Data Setup

To simulate the vulnerable environment:

1. Install Plugin: Tablesome version 1.2.1.
2. Create Table:
   • wp eval "/* Code to create a Tablesome table with ID 1 */"
   • Alternatively, use the UI to create a table named "Email Logs".
3. Enable Logging: In Tablesome settings, ensure that contact form submissions or WordPress emails are directed to "Table 1".
4. Create Users:
   • Administrator: admin
   • Subscriber: attacker
5. Shortcode Page: (If needed for nonce)
   wp post create --post_type=page --post_status=publish --post_title="Tablesome" --post_content='[tablesome table_id="1"]'

7. Expected Results

• The get_table_data request returns a 200 OK status.
• The response body contains JSON data representing the rows of the table.
• The table data includes entries for the password reset email sent to the administrator, including the key and login parameters.

8. Verification Steps

1. Verify Exposure: Check if the JSON response contains the admin's email content.
2. Verify Takeover: After using the leaked key to reset the password, attempt to login as admin with the new password.
3. Database Check: Use wp user get admin to confirm the account still exists and has the administrator role.

9. Alternative Approaches

• REST API: Check if the plugin registers REST routes under wp-json/tablesome/v1/. If so, check for missing permission_callback on table data endpoints.
• Table Brute Force: If table_id=1 is empty, iterate through table_id=1 to table_id=20 to find where the logs are stored.
• Direct Database ID: If the plugin uses UUIDs instead of integer IDs, look for an endpoint that lists available table headers/metadata accessible to Subscribers.