TablePress WordPress Plugin Vulnerability Impacts 700K+ Sites

A critical security vulnerability in the TablePress plugin impacts over 700,000 WordPress sites.

The TablePress WordPress plugin poses a significant security risk affecting over 700,000 sites. The vulnerability is exposed to attacks by storing cross-site scripting (XSS), whereby malicious scripts are supplied and then executed each time the end-user visits the affected pages.

TablePress Plugin Overview

TablePress is a second free tool that is used to create and maintain interactive tabular data on WordPress sites. It has also included functionality such as sorting, pagination, and search, making it a favorite tool for organizing content in a tabular format.

The exploit relies on how TablePress interprets the shortcode parameter, which lacks reasonable input sanitization and output escaping, fundamental security measures that are likely to protect against malicious inputs and malicious output.

The Wordfence advisory says:

“The TablePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shortcode_debug’ parameter in all versions up to, and including, 3.2 due to insufficient input sanitization and output escaping.”

Role of Input Sanitization and Output Escaping

Input Sanitization and Output Escaping play the following critical role:

• Input Sanitization: Filters and blocks malicious code or harmful data typed into the fields or forms. It is one of those steps that TablePress failed to pursue to its full extent, and as a result, allowed malicious code to pass through.
• Output Escaping: Prevents the existence of an attacker who produces web content containing executable code by selectively filtering out inappropriate characters in output. TablePress had inadequate escaping, allowing malicious scripts to be displayed on web pages.

This bi-directional failure provides the attacker with Contributor-level access or higher, enabling them to inject scripts that are stored and automatically executed every time the affected content is rendered.

Although Contributor-level authorization will help decrease the likelihood of large-scale exploitation, web administrators must take further action. This vulnerability can be addressed by version 3.2.1 or higher.

Final Thoughts

This is one of those examples that highlights the importance of staying current and thorough in managing WordPress plug-ins from a security perspective. It is essential to keep the latest version of the plug-ins to protect websites against emerging threats.