Executive brief
The DataPress (Dataverse Integration) WordPress plugin is used to integrate Microsoft Dataverse data into WordPress sites. The plugin fails to properly restrict access to its template rendering features, allowing low-privilege users (such as Contributors) to inject malicious template code that exposes sensitive information—including session cookies—of higher-privilege users who view the affected content. An attacker could potentially hijack administrator accounts through this exposure.
Technical details
This is a Server-Side Template Injection (SSTI) vulnerability in the plugin's Twig template rendering engine. The vulnerable component is the `[icds_twig]` shortcode handler, which does not properly validate or sandbox user-supplied template code before rendering. The attack requires the attacker to have Contributor-level privileges (or higher), which is a built-in WordPress role. By inserting malicious Twig expressions (e.g., `{{ dump() }}`) into post content via the shortcode, the attacker can extract the context array that contains cookies and session tokens of users who subsequently view the post. No user interaction beyond viewing is required. The plugin version 2.91 and later include a fix; the vulnerable behavior occurs when the `ICDS_TWIG_USE_PRIVILEGES` setting is disabled (the default state).
Affected products
- DataPress Dataverse Integration before 2.91
Timeline
- 2026-06-02: disclosed
- 2026-06-02: patched: Fixed in version 2.91
- 2026-08-06: advisory