Now officially on WordPress.org

CVE Database / CVE-2024-4354

CVE · Medium

CVE-2024-4354 — TablePress – Tables in WordPress made easy [tablepress] < 2.3.2

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2024-4354 TablePress – Tables in WordPress made easy [tablepress] < 2.3.2 Server-Side Request Forgery (SSRF) Medium 6.4 < 2.3.2 2.3.2 2024-06-06 —

CVE-2024-4354

The TablePress plugin for WordPress contains a server-side request forgery vulnerability in the get_files_to_import() function affecting versions up to 2.3. Authenticated users with author privileges or higher can exploit this flaw to initiate web requests to arbitrary destinations from the website server, potentially allowing them to access or modify data from internal services. The vulnerability was remedied by limiting the URL import feature to administrators only, as a complete fix would require core WordPress changes to functions like wp_safe_remote_get(). The issue was resolved in version 2.3.2.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings