JVN#05398317: WordPress plugin "TablePress" vulnerable to improper restriction of XML external entity (XXE) references

The WordPress plugin “TablePress” is a plugin to create and manage tables on WordPress site. TablePress contains a vulnerability where XML external entity (XXE) references are not properly restricted (CWE-611).

Impact

An arbitrary file on the server may be accessed by users who can access the configuration page of the plugin (users with Author or higher role).

Solution

Update the plugin
Update the plugin according to the information provided by the developer.

Products Affected

• TablePress prior to version 1.8.1