Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

wp-Table plugin can run attacker code via URL

CVE-2007-2484 · published 19 years ago
Summary

The wp-Table plugin for WordPress (version 1.43 and earlier) accepts a URL parameter that can be tricked into loading a file from anywhere on the internet if the server setting 'register_globals' is turned on. This lets an attacker execute their own PHP code on your site, potentially taking control of the site or stealing data. Disable the 'register_globals' setting or update/remove the vulnerable plugin as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ruben_boelinger wp-table <= 1.43
cpe:2.3:a:ruben_boelinger:wp-table:*:*:*:*:*:*:*:*
Original advisory text
PHP remote file inclusion vulnerability in js/wptable-button.php in the wp-Table 1.43 and earlier plugin for WordPress, when register_globals is enabled, allows remote attackers to execute arbitrar...
PHP remote file inclusion vulnerability in js/wptable-button.php in the wp-Table 1.43 and earlier plugin for WordPress, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the wpPATH parameter.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.8 Medium
Exploitation
45% chance of attack within 30 days
Timeline
Published3 May 2007
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2007-2484 · NVD
Track software like this
Free during beta