Hi @woocomuser,
disabling exports is not an option, I’m afraid. It’s a very much needed and useful feature for users to create backups of their tables via exporting, or for data migration of tables from one site to another.
The same for formulas in general: TablePress is a table and spreadsheet plugin and many users use math formulas for calculations. Thus, it’s vital that these are exported as well. Note that TablePress itself only supports safe formulas.
Unfortunately, just removing/stripping potentially malicious formulas is not really possible, as there’s such a wide variety and so many way to obfuscate them. Otherwise, I would of course already have done that.
In addition, I’m of the strong opinion that TablePress is not to blame here:
First, a site would already have to be compromised for an attacker to do something malicious. Then, the victim would have to have re-enabled a dangerous Excel feature in the Excel program options (one where Microsoft explicitly says “not recommended”). And on top of that, that user would have to ignore at least to very clear security warnings.
I was in fact already able to convince Wordfence of this, but their notifications rely on the global CVE security database. I’ve already contacted the responsible organization, MITRE, regarding removing that entry, but unfortunately haven’t heard back from them. So, until they remove the entry, we’ll have to live with that warning it looks like. Please believe me that I’m the last person that wants this. As you can imagine all this has put a severe level of work on me in the last weeks.
Regards,
Tobias
