Vulnerability record · CVE-2007-2484 · published 3 May 2007
CVE-2007-2484: wp-Table WordPress plugin remote file inclusion via wpPATH
RRuben Boelinger · Wp Table
The wp-Table plugin 1.43 and earlier for WordPress includes js/wptable-button.php without validating the wpPATH parameter, allowing a remote attacker to supply a URL to an attacker-controlled PHP file. When register_globals is enabled, that file is included and executed, giving remote code execution on the web server. The flaw matters because it turns a simple HTTP request into full PHP code execution on the host.
Description
PHP remote file inclusion vulnerability in js/wptable-button.php in the wp-Table 1.43 and earlier plugin for WordPress, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the wpPATH parameter.
AV:N/AC:M/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote code execution with public exploit code and a very high EPSS percentile, though exploitation requires register_globals to be enabled.
What it is
The wp-Table plugin 1.43 and earlier for WordPress includes js/wptable-button.php without validating the wpPATH parameter, allowing a remote attacker to supply a URL to an attacker-controlled PHP file. When register_globals is enabled, that file is included and executed, giving remote code execution on the web server. The flaw matters because it turns a simple HTTP request into full PHP code execution on the host.
Impact
An unauthenticated attacker can execute arbitrary PHP code in the context of the web server, leading to full site compromise, data theft, or use of the host as a foothold. No credentials are needed beyond reachability of the vulnerable script.
Attack surface
Reached over the network via an HTTP request to js/wptable-button.php with a crafted wpPATH parameter; no authentication or user interaction is required. Exploitation depends on the PHP register_globals setting being enabled, which is a configuration precondition rather than an attacker-supplied value.
Exploitation
CISA KEV does not list this CVE, but EPSS is high (0.45355, 98.7th percentile) and a public Exploit-DB entry (3824) exists, indicating exploit code is publicly available. No ransomware group usage is documented.
What to do
- Update or remove the wp-Table plugin; versions after 1.43 are the fix path, and if no fixed release is available, deactivate and delete the plugin.
- Disable register_globals in php.ini, since the vulnerability requires it to be enabled.
- Restrict outbound and inbound access so the web server cannot fetch or include remote URLs (disable allow_url_include and allow_url_fopen where feasible).
- Apply a WAF rule blocking requests to js/wptable-button.php with external URLs in the wpPATH parameter.
- Audit the WordPress installation for other outdated plugins and enforce a patch cadence.
Detection
- Search web logs for requests to js/wptable-button.php containing wpPATH with an http:// or https:// value.
- Monitor for unexpected outbound HTTP requests from the web server to unknown hosts, which may indicate remote file inclusion.
- Check for newly created or modified PHP files in the WordPress web root and upload directories.
- Review PHP error logs for include or fopen warnings referencing remote URLs.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-2484 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-2484), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
