XML External Entity (XXE) vulnerabilities in WordPress plugins and themes

XXE abuses an XML parser configured to resolve external entities. A crafted document makes the parser fetch a file from disk or a URL on the internal network and fold the result into the parsed output, turning a document upload into file disclosure.

What an attacker can do: make the XML parser read local files or reach internal services CWE-611