Advanced XML Reader Plugin <= 0.3.4 - XML External Entity Injection
Strategic Overview
Vulnerability Overview
The Advanced XML Reader plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in versions up to, and including, 0.3.4. This can allow authenticated attackers to extract sensitive data or achieve code execution in vulnerable configurations.
Technical Analysis
REMEDIATION: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. --- IDENTIFIER: CWE-611 (Improper Restriction of XML External Entity Reference) The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C