CVE-2019-20180

CVE-2019-20180

EPSS 2.3%

The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor disputes this issue and argues that this responsibility lies with the application that opens the CSV file and not TablePress.

Affected products

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://medium.com/%40Pablo0xSantiago/cve-2019-20180-tablepress-version-1-9-2-csv-injection-65309fcc8be8 https://wordpress.org/support/topic/security-issue-cve-2019-20180-for-tablepress/#post-16282996 https://wpvulndb.com/vulnerabilities/10016