Vulnerability Found | WordPress.org

Resolved itsjeffersonli
(@itsjeffersonli)

3 years, 7 months ago

Hello Tobias Bäthge,

I recently found a vulnerability in your Table Press Login can we chat personally via email so i can show the proof of concept to you thank you =)

Viewing 4 replies - 1 through 4 (of 4 total)

Moderator Yui
(@fierevere)

永子

3 years, 7 months ago

@itsjeffersonli
Please do not open any details publicly, consider using this topic only to obtain author contacts.

Or you can use https://developer.wordpress.org/plugins/wordpress-org/plugin-security/reporting-plugin-security-issues/

Plugin Author Tobias Bäthge
(@tobiasbg)

3 years, 7 months ago

Hi @itsjeffersonli,

thanks for your post. Please send me an email to tobias at tablepress dot org . Thanks!

Regards,
Tobias

wordmax
(@wordmax)

3 years, 7 months ago

Any update on this? Thanks

Plugin Author Tobias Bäthge
(@tobiasbg)

3 years, 7 months ago

Hi,

as an update for everybody:
After reviewing this, it turned out to be a case of https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/#why-are-some-users-allowed-to-post-unfiltered-html
Admin users are allowed to add arbitrary HTML code to table cells as well, just as they can add it to a normal post or page, due to the unfiltered_html capability. Thus, there’s no security issue here in TablePress.

Still, thanks to itsjeffersonli for looking into this and for getting in touch!

Regards,
Tobias

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Vulnerability Found’ is closed to new replies.

5 replies
4 participants
Last reply from: Tobias Bäthge
Last activity: 3 years, 7 months ago
Status: resolved