What’s Vulnerable › Vulnerabilities

CVE-2024-23825: TablePress SSRF vulnerability due to insufficient filtering of cloud provider hosts

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-01-30 · updated 2026-06-17
• Weakness: CWE-918

Description

TablePress is a table plugin for Wordpress. For importing tables, TablePress makes external HTTP requests based on a URL that is provided by the user. That user input is filtered insufficiently, which makes it is possible to send requests to unintended network locations and receive responses. On sites in a cloud environment like AWS, an attacker can potentially make GET requests to the instance's metadata REST API. If the instance's configuration is insecure, this can lead to the exposure of internal data, including credentials. This vulnerability is fixed in 2.2.5.

Affected products

• tobiasbg TablePress – Tables in WordPress made easy: before 2.2.5 — fixed in 2.2.5

How to fix

Upgrade to a fixed version: tobiasbg TablePress – Tables in WordPress made easy 2.2.5. Check the vendor advisory for mitigations.

References

• https://github.com/TablePress/TablePress/commit/62aab50e7a9c486caaeff26dff4dc01e059ecb91
• https://github.com/TablePress/TablePress/security/advisories/GHSA-x8rf-c8x6-mrpg
• https://github.com/TablePress/TablePress/commit/62aab50e7a9c486caaeff26dff4dc01e059ecb91
• https://github.com/TablePress/TablePress/security/advisories/GHSA-x8rf-c8x6-mrpg

Get alerted when CVE-2024-23825 or the next vulnerability affects your stack