Vulnerability Name:

CVE-2019-20180 (CCN-174210)

Assigned:2019-12-31
Published:2020-01-09
Updated:2026-06-17
Summary:The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users.
Note: The vendor disputes this issue and argues that this responsibility lies with the application that opens the CSV file and not TablePress.
CVSS v40 Severity:
CVSS v3.x Severity:6.8 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)
5.9 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): High
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:6.0 Medium (CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
4.3 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-1236
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2019-20180

Source: XF
Type: UNKNOWN
wp-cve201920180-cmd-exec(174210)

Source: af854a3a-2127-422b-91ae-364da2661108
Type: UNKNOWN
af854a3a-2127-422b-91ae-364da2661108

Source: cve@mitre.org
Type: UNKNOWN
cve@mitre.org

Source: CCN
Type: WordPress Plugins Directory
TablePress plugin for WordPress

Source: af854a3a-2127-422b-91ae-364da2661108
Type: UNKNOWN
af854a3a-2127-422b-91ae-364da2661108

Source: cve@mitre.org
Type: UNKNOWN
cve@mitre.org

Source: af854a3a-2127-422b-91ae-364da2661108
Type: UNKNOWN
af854a3a-2127-422b-91ae-364da2661108

Source: CCN
Type: WP VulnDB Web site
TablePress < 1.10 - CSV Injection

Source: cve@mitre.org
Type: UNKNOWN
cve@mitre.org

Vulnerable Configuration:Configuration 1:
  • cpe:2.3:a:tablepress:tablepress:*:*:*:*:*:wordpress:*:* (Version <= 1.9.2)

    • Configuration CCN 1:
  • cpe:2.3:a:tablepress:tablepress:1.9.2:*:*:*:*:wordpress:*:*
  • AND
  • cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    tablepress tablepress *
    tablepress tablepress 1.9.2
    wordpress wordpress *